CSP Validator

Paste your Content-Security-Policy header value to parse directives, detect unsafe values, and get actionable recommendations.

Why Content Security Policy Is Worth the Effort

Cross-site scripting remains one of the most common classes of web vulnerability because it only takes one unescaped output — one comment field, one query parameter reflected into HTML — for an attacker to run their JavaScript in your users' browsers. A Content Security Policy is the browser-enforced backstop for that moment: even if the injection lands, the script has nowhere to load from and nowhere to send data, because the policy never authorised it.

The catch is that most deployed CSPs are ineffective. A policy containing script-src 'unsafe-inline'— or a long allowlist that includes a CDN hosting user-uploadable content — can be bypassed trivially, which is why this validator flags unsafe values rather than just checking that a header exists. Research from Google's security team found the large majority of real-world allowlist-based policies to be bypassable, which motivated the nonce-based "strict CSP" pattern this tool recommends.

A practical rollout looks like this: start with Content-Security-Policy-Report-Only and a report endpoint, watch a week of violation reports, fix the legitimate breakages (usually inline event handlers and third-party widgets), then enforce. Revisit the policy whenever you add a new script vendor — a stale CSP that teams route around with unsafe-inline is worse than an honest, smaller one.

The Directives That Do the Heavy Lifting

script-src
Your primary XSS defence. Aim for nonces or hashes; every unsafe-inline here is a hole in the policy.
default-src
The fallback for every resource type you didn't name. Set it to 'self' (or 'none') so nothing slips through unlisted.
object-src + base-uri
Two classic bypass routes: plugins and <base> tag hijacking. Set object-src 'none' and base-uri 'self' in every policy.
frame-ancestors
Controls who may embed YOUR site in a frame — the clickjacking defence, replacing X-Frame-Options.
connect-src
Limits where fetch/XHR/WebSocket requests may go — the directive that stops injected code from exfiltrating data.
form-action
Restricts where forms can submit. Without it, injected markup can redirect a login form to an attacker host.

Frequently Asked Questions

What is a Content Security Policy?

CSP is an HTTP header that controls which resources a browser may load. A well-configured CSP is one of the most effective defences against Cross-Site Scripting (XSS) attacks.

What does 'unsafe-inline' mean?

'unsafe-inline' in script-src allows inline JavaScript, significantly weakening XSS protection. Replace it with nonces or hashes, or move code to external files.

What is the difference between script-src and default-src?

default-src is a fallback for all resource types without their own directive. script-src overrides default-src for scripts. Set both: restrictive default-src, then override specific types.

Should I use report-only mode first?

Yes. Content-Security-Policy-Report-Only tests without blocking. Violations are reported to report-uri so you can fix what would break before enforcing.

What is 'strict-dynamic' and when should I use it?

'strict-dynamic' tells the browser to trust any script loaded by an already-trusted script, while ignoring allowlisted hosts entirely. Combined with nonces it enables the modern 'strict CSP' pattern recommended by Google: script-src 'nonce-{random}' 'strict-dynamic'. It solves the problem of third-party scripts loading their own dependencies from hosts you never allowlisted.

Should I use nonces or hashes for inline scripts?

Use nonces when your HTML is generated per-request — the server injects a fresh random value into the header and each script tag. Use hashes (sha256-…) when pages are statically generated and the inline script content never changes. Both are strictly safer than unsafe-inline; nonces are usually easier to maintain at scale.

Does a CSP stop all XSS attacks?

No — CSP is a mitigation layer, not a replacement for output encoding and input validation. A strong policy blocks the most common exploitation paths (injected inline scripts, external script loads), but DOM-based XSS inside already-trusted code still executes. Treat CSP as your safety net for the day your primary defences fail.

Do I still need X-Frame-Options if I set frame-ancestors?

frame-ancestors is the modern replacement for X-Frame-Options and takes precedence in every current browser, with more flexibility (you can allowlist specific origins). Keeping X-Frame-Options: DENY alongside it is harmless and covers a shrinking set of legacy clients, so most sites send both during transition.

Keep Your CSP Enforced Without Drift

CertNotify monitors your security headers continuously and alerts you the moment a CSP, HSTS, or other critical header changes or disappears.

Start Monitoring FreeBrowse All Tools
Related Free Tools
HSTS CheckerSecurity Headers