Content Security Policy Auditor
Inspect an existing CSP for duplicate directives and specific source-expression risks.
Loading tool…
How to use Content Security Policy Auditor
Inspect an existing CSP for duplicate directives and specific source-expression risks. The first occurrence of each directive is retained as browsers require. Review indicators include broad schemes, unsafe keywords and missing explicit object/base/frame restrictions.
- Provide the input and select the documented mode or options.
- Run the tool and review its result and any limits reported below.
- Copy the text result or download a separate output file.
Good to know
- Static indicators are not complete CSP validation or an assurance of security. Nonces, hashes, strict-dynamic, browser support and delivery context need human review.
- 10,000 characters and100 directives. No page is fetched and the submitted policy is never applied to this site.
- Processing happens in this browser tab. Inputs and results are not automatically saved or uploaded.
Common questions
What does Content Security Policy Auditor process?
The first occurrence of each directive is retained as browsers require. Review indicators include broad schemes, unsafe keywords and missing explicit object/base/frame restrictions.
What happens to my original input?
The tool creates a separate result. Selected files and pasted data remain on this device; inspect the result before using it in another system.
Keep going with related tools
All seo →JSON Formatter
Format and indent valid JSON in your browser, with downloadable output and clear syntax errors.
DeveloperYAML Formatter
Format standard YAML with readable indentation, duplicate-key checks, and bounded alias handling.
DeveloperInline CSP Hash Source Builder
Extract selected inline HTML script and style text, then export exact UTF-8 hash sources with parsed-content evidence.
DeveloperPermissions Policy Workbench
Build or inspect supported Permissions-Policy headers and iframe allow grammar.