CSP Validator

Cross-site scripting remains one of the most common classes of web vulnerability because it only takes one unescaped output — one comment field, one query parameter reflected into HTML — for an attacker to run their JavaScript in your users' browsers. A Content Security Policy is the browser-enforced backstop for that moment: even if the injection lands, the script has nowhere to load from and nowhere to send data, because the policy never authorised it.

The catch is that most deployed CSPs are ineffective. A policy containing script-src 'unsafe-inline'— or a long allowlist that includes a CDN hosting user-uploadable content — can be bypassed trivially, which is why this validator flags unsafe values rather than just checking that a header exists. Research from Google's security team found the large majority of real-world allowlist-based policies to be bypassable, which motivated the nonce-based "strict CSP" pattern this tool recommends.

A practical rollout looks like this: start with Content-Security-Policy-Report-Only and a report endpoint, watch a week of violation reports, fix the legitimate breakages (usually inline event handlers and third-party widgets), then enforce. Revisit the policy whenever you add a new script vendor — a stale CSP that teams route around with unsafe-inline is worse than an honest, smaller one.