Content Security Policy (CSP) checker
A Content-Security-Policy is only as strong as its weakest line, and it is easy to ship one that looks strict and blocks almost nothing. Paste a URL and this free CSP checker shows the policy a browser really applies, and what each weak spot lets through.
This checked one URL, once.
VitalSentinel audits the whole page in one pass: this check plus every other technical SEO and performance issue on it, scored and ordered by what to fix first. Ask Theo, the AI assistant in the app, and it explains any finding in plain words.
What it checks
- Finds the policy wherever it arrives: one header, several headers, Report-Only, or a meta tag, which silently drops frame-ancestors, report-uri and sandbox
- Works out what a browser really allows when more than one policy is enforced, because a script has to pass all of them
- Flags 'unsafe-inline', 'unsafe-eval', a wildcard in script-src, plain http: sources, and allowed hosts known to hand an attacker a way around the policy
- Follows what default-src covers, then flags base-uri, form-action and frame-ancestors when they are missing, because none of those three falls back to it
What it does not
- Two enforced policies are compared as text, so when they write the same source in different ways the real policy may be stricter than what we show, never looser
- It reads the HTML your server sends, so a policy your JavaScript adds after the page loads is invisible to this check
- One URL per run, and the policy that matters most is the one on the page handling logins, checkout or anything else a visitor types into
- It can measure how long a nonce is and what it is made of, never whether it changes on every page load
Questions
My policy has 'unsafe-inline' and a nonce. Is that broken?
No, that is the normal way to stay compatible with older browsers. Every current browser ignores 'unsafe-inline' whenever a nonce or a hash appears in the same rule, so the nonce is what applies and the weaker setting is only there for browsers nobody uses any more.
Why does the tool report two policies when I only set one header?
Three ways that happens.
- Something between your site and the visitor adds one, usually a CDN, a proxy or a security product.
- Your own header value contains a comma, which browsers read as two separate policies.
- Or the page carries a meta http-equiv policy alongside the header, and this check lists it separately because a browser applies it separately.
Each policy applies on its own, so a script has to be allowed by all of them to run. A Report-Only policy in the list still enforces nothing.
What does 'strict-dynamic' actually change?
Browsers that support it stop consulting your list of allowed script hosts and instead trust any script loaded by a script you already trusted. That is how a nonce-based policy survives a tag manager. Older browsers fall back to the list.
Should I start with Report-Only?
Yes, on any site with real traffic. Ship the policy you want in Content-Security-Policy-Report-Only along with an address for the reports, because without one nothing reaches you.
Watch for a week or two, fix what breaks, then move the same value into the header that enforces.
More free tools
Fair use, and how to recognize us
5 per minute · 25 per hour · 100 per day per IP (per /64 for IPv6), plus a per-site limit
Every request these tools make sends this user agent, including the ones that load a page in a real browser. What a run records is set out in our privacy policy.
Mozilla/5.0 (compatible; VitalSentinel Free Tools Bot/1.0; +https://www.vitalsentinel.com/bot)
Stop checking by hand
Core Web Vitals from real users, indexing and robots.txt, uptime and SSL, monitored continuously. Start on the Free plan and add your first domain in under a minute.