Content Security Policy (CSP) Checker
A Content-Security-Policy is only as strong as its weakest line, and it is easy to ship one that looks strict and blocks almost nothing. Paste a URL and this free CSP checker shows the policy a browser really applies, and what each weak spot lets through.
This checked one URL, once.
VitalSentinel Inspector audits the whole page in one pass: this check plus every other technical SEO and performance issue on it, scored and ordered by what to fix first.
Free plan, no credit cardWhat it checks
- Finds the policy wherever it arrives: one header, several headers, Report-Only, or a meta tag, which silently drops frame-ancestors, report-uri and sandbox
- Works out what a browser really allows when more than one policy is enforced, because a script has to pass all of them
- Flags 'unsafe-inline', 'unsafe-eval', a wildcard in script-src, plain http: sources, and allowed hosts known to hand an attacker a way around the policy
- Follows what default-src covers, then flags base-uri, form-action and frame-ancestors when they are missing, because none of those three falls back to it
What it does not
- Two enforced policies are compared as text, so when they write the same source in different ways the real policy may be stricter than what we show, never looser
- It reads the HTML your server sends, so a policy your JavaScript adds after the page loads is invisible to this check
- One URL per run, and the policy that matters most is the one on the page handling logins, checkout or anything else a visitor types into
- It can measure how long a nonce is and what it is made of, never whether it changes on every page load
Questions
- My policy has 'unsafe-inline' and a nonce. Is that broken?
- No, that is the normal way to stay compatible with older browsers. Every current browser ignores 'unsafe-inline' whenever a nonce or a hash appears in the same rule, so the nonce is what applies and the weaker setting is only there for browsers nobody uses any more.
- Why does the tool report two policies when I only set one header?
- Three ways that happens. Something between your site and the visitor adds one, usually a CDN, a proxy or a security product. Your own header value contains a comma, which browsers read as two separate policies. Or the page carries a meta http-equiv policy alongside the header, and this check lists it separately because a browser applies it separately. Each policy applies on its own, so a script has to be allowed by all of them to run. A Report-Only policy in the list still enforces nothing.
- What does 'strict-dynamic' actually change?
- Browsers that support it stop consulting your list of allowed script hosts and instead trust any script loaded by a script you already trusted. That is how a nonce-based policy survives a tag manager. Older browsers fall back to the list.
- Should I start with Report-Only?
- Yes, on any site with real traffic. Ship the policy you want in Content-Security-Policy-Report-Only along with an address for the reports, because without one nothing reaches you. Watch for a week or two, fix what breaks, then move the same value into the header that enforces.
More free tools
Fair use, and how to recognize us
5 per minute · 25 per hour · 100 per day per IP (per /64 for IPv6), plus a per-site limit
Every request these tools make sends this user agent, including the ones that load a page in a real browser. What a run records is set out in our privacy policy.
Mozilla/5.0 (compatible; VitalSentinel Free Tools Bot/1.0; +https://www.vitalsentinel.com/bot)
Stop checking by hand
Uptime, Core Web Vitals, indexing and robots.txt, monitored continuously. Start on the free plan and add your first domain in under a minute.