Free Content Security Policy (CSP) Evaluator
Paste a Content-Security-Policy and get an A-F grade · with specific fixes for unsafe-inline, unsafe-eval, wildcards, and missing directives.
Frequently asked
What makes a CSP weak?
The most common weaknesses are 'unsafe-inline' and 'unsafe-eval' in script-src (they defeat most XSS protection), wildcard * sources, missing object-src 'none', and no default-src fallback. The evaluator flags each and explains the fix.
Is my policy uploaded anywhere?
No. The evaluator parses and grades the policy entirely in your browser. Nothing is sent to a server.
Related tools
- Password Strength Checker · Test any password's strength · entropy, estimated crack time, and detection of common patterns and dictionary words.
- Email Header Analyzer · Paste raw email headers and get the story: did SPF, DKIM and DMARC pass, what path did the message take, and does anything look spoofed.
- Punycode Converter · Convert Unicode domains to xn-- punycode and back · and check whether a domain mixes scripts the way phishing lookalikes do.