free_csp_scanner

Is your CSP actually protecting you?

Enter a URL and we'll grade its Content-Security-Policy: missing directives, unsafe-inline, over-broad sources, and whether it reports violations at all. Free, no sign-up.

What we check.

checks
missing

Directives that aren't there.

No script-src? No object-src? No policy at all? The most common CSP problem is absence — we flag every load-bearing directive your header should have.

unsafe

Directives that undo themselves.

'unsafe-inline' and 'unsafe-eval' in script-src re-open the exact attack CSP exists to block. We grade them accordingly.

broad

Sources that allow anyone.

Wildcards, bare https:, whole CDN domains anyone can upload to — a guest list that says "everyone" isn't a guest list.

silent

Whether anyone is listening.

A policy without report-uri / report-to fails silently: you never learn what it blocked, or what it missed. Only 13% of sites with a CSP report violations.

What you get back.

example
Basic
example-shop.com

A policy exists, but 'unsafe-inline' and a missing report-uri leave the door open.

example scorecard · your results in ~5 seconds

  • high
    'unsafe-inline' in script-src
    Any injected inline script will execute — this neutralises most of the policy's value.
  • medium
    No violation reporting configured
    Without report-uri or report-to, the policy fails silently and can't be safely tightened.
  • good
    default-src is restrictive
    'self' as the fallback is the right foundation to build on.

The scan shows what's wrong.
csplog shows what to allow.

then_what

A rating tells you today's header is weak; it can't tell you what a strong one looks like for your traffic. csplog collects the violation reports your visitors' browsers already send, drops extension, antivirus and bot noise before it reaches you, and assembles a policy from the origins you approve, with a plain-English explanation per directive. Then it fetches your pages to check the header really went live. From €7/month in the EU, $8/month elsewhere. 14-day trial, no credit card.

get_notified read_the_csp_guide
launching_soon · want to fix it yourself first? the guide covers nonces, report-only mode and rollout.