Free tool · no signup

CSP checker

Paste your Content-Security-Policy and see what is weak about it: unsafe-inline, wildcards, risky CDNs and missing directives, each with the fix. The policy is read in your browser.

By the Bug Circuit security team · Last updated October 27, 2026

Paste your Content-Security-Policy headerThe whole header line or just its value. Copy it from your browser's developer tools (Network tab, then the response headers) or from your server config.

How do I check a Content-Security-Policy? Copy the header from your site (browser developer tools, Network tab, response headers) and paste it below. The checker grades it A to F and explains each weakness. The most serious are scripts allowed from anywhere and 'unsafe-inline' without a nonce.

How it works

What it looks for

The checker follows the same ideas as Google's CSP Evaluator. In script-src (or default-src when there is no script-src) it flags a missing restriction, 'unsafe-inline' with no nonce or hash, 'unsafe-eval', a * wildcard, bare http: or https: schemes, data: URLs and plain http sources. It also flags allowlisted CDNs that host files attackers can abuse to bypass a host-based policy.

Beyond scripts it checks that object-src is 'none', that base-uri is set, that frame-ancestors is set (clickjacking), whether form-action restricts where forms post, and whether upgrade-insecure-requests is on. A Report-Only header is called out because it blocks nothing.

How the grade works

Each finding takes points off 100 according to how much it weakens the policy: critical 40, high 25, medium 10, low 3. A to F is then 90, 75, 55 and 35 and above. The grade is a guide for comparing your own versions, not a certificate: a policy that grades well but breaks your checkout is no use, and one that grades poorly may still be fine for a static site.

Fixing what it finds

The usual fix is to replace a long list of allowed script hosts with a nonce and 'strict-dynamic', add object-src 'none' and base-uri 'none', and set frame-ancestors. The CSP generator builds a policy like that for you. Test changes in Report-Only mode first.

Worked examples

A weak policy

A common starting point copied from a tutorial.

default-src *; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com

Grade F or D. Scripts run inline and through eval, any host can serve other content, and object-src, base-uri and frame-ancestors are missing.

A strong policy

A nonce-based policy.

default-src 'self'; script-src 'nonce-r4nd0m' 'strict-dynamic' https: 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests

Grade A. 'unsafe-inline' and https: are only fallbacks for old browsers and are ignored where nonces and strict-dynamic are supported.

Frequently asked questions

Where do I find my CSP header?

Open your site, open the browser developer tools, go to the Network tab, reload, click the first request and look at the response headers for Content-Security-Policy. You can also look in your server or hosting configuration.

Is 'unsafe-inline' always bad?

For scripts, yes, unless a nonce, hash or 'strict-dynamic' is present, in which case modern browsers ignore it. For styles it is a smaller risk and very common.

Why are some CDNs flagged?

Some popular CDNs and Google hosts serve JSONP endpoints or libraries that can be used to run arbitrary script, which defeats an allowlist. A nonce with strict-dynamic avoids relying on them.

Does a good grade mean my site is safe?

No. It means the policy does not have common weaknesses. A CSP reduces the damage of an injection bug, but the bug itself still needs to be found and fixed.

What if I have no CSP?

Then scripts from anywhere can run on your pages. Use the CSP generator to build a first policy, start in Report-Only mode and tighten it over time.

Is my policy sent anywhere?

No. The checker runs entirely in your browser.

Keep reading

CSP GeneratorBuild a policy from scratch.Security Headers CheckerCheck the rest of your headers.Is my website hackable?What attackers look at first.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing