CSP analyser

Paste a policy. You get every directive broken out, the default-src fallbacks resolved, and the findings that actually change what the policy enforces.

Runs entirely in your browser — the policy is never sent anywhere

The two rules this checks that others miss

A nonce or hash makes 'unsafe-inline' inert. Browsers supporting CSP2 and up ignore 'unsafe-inline' whenever a nonce or hash appears in the same directive. Policies carry both deliberately, to serve older browsers. Reporting that as critical is a false positive.

'strict-dynamic' makes the host allowlist inert. Trust flows from the nonce to whatever the trusted script loads, and the host list is ignored by modern browsers entirely.

Directives that do not fall back to default-src

This is where real policies leak. base-uri, form-action and frame-ancestors are not covered by default-src, so a policy without them is missing that protection no matter how tight default-src is. Missing base-uri in particular can undo a nonce-based policy, because an injected <base> tag redirects your own approved scripts.

Every directive, with its fallback behaviour →