Free CSP scanner

Is your CSP actually protecting you?

Enter a URL and we'll grade its Content-Security-Policy: missing directives, unsafe-inline, over-broad sources, and whether it reports violations at all. Free, no sign-up.

What we check.

checks

missing

Directives that aren't there.

No script-src? No object-src? No policy at all? The most common CSP problem is absence, so we flag every load-bearing directive your header should have.

unsafe

Directives that undo themselves.

'unsafe-inline' and 'unsafe-eval' in script-src re-open the exact attack CSP exists to block. We grade them accordingly.

broad

Sources that allow anyone.

Wildcards, bare https:, whole CDN domains anyone can upload to. A guest list that says "everyone" isn't a guest list.

silent

Whether anyone is listening.

A policy without report-uri / report-to fails silently: you never learn what it blocked, or what it missed.

What you get back.

example
Basic
example-shop.com

A policy exists, but 'unsafe-inline' and a missing report-uri leave the door open.

example scorecard · your results in ~5 seconds

  • high
    script-src allows 'unsafe-inline'
    Inline scripts are permitted, which largely defeats the policy's XSS protection. Use nonces or hashes instead.
  • medium
    No violation reporting configured
    Without report-uri or report-to, the policy fails silently and can't be safely tightened.
  • low
    No base-uri directive
    Set base-uri 'self' (or 'none') to block <base> tag injection that can hijack relative URLs.

The scan shows what's wrong.
csplog shows what to allow.

Then what

A rating tells you today's header is weak; it can't tell you what a strong one looks like for your traffic. csplog collects the violation reports your visitors' browsers already send, drops extension, antivirus and bot noise before it reaches you, and assembles a policy from the origins you Allow. Then it fetches your pages to check the header really went live. From €9/month in the EU, $10/month elsewhere. 14-day trial, no credit card.

Get notified Read the CSP guide
Launching soon. The guide covers nonces, Report-Only mode and rollout if you would rather fix it yourself first.