Validate CSP

Check a Content-Security-Policy for syntax, unsafe sources, and contradictory directives.

freeworks offlinenothing uploaded
ToolCSP Validator
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

CSP text is tokenized into directives and source expressions, then checked for syntax, deprecated tokens, contradictory sources, and unsafe allowances. The validator reports policy intent without loading a protected page.

  • default-src supplies fallback coverage.
  • script-src and object-src deserve explicit review.

Worked example

Validate CSP header with unsafe-inline warning
Check a Content Security Policy for errors. Detects unsafe-inline in script-src and wildcard in img-src
Input
											default-src 'self'; script-src 'self' 'unsafe-inline'; img-src *
Output
												CSP is valid but has 3 warning(s)

Directives found: 3

Warnings:
  - "script-src" allows 'unsafe-inline' - XSS risk
  - "img-src" uses wildcard (*) - allows any source
  - Missing 'frame-ancestors' - clickjacking protection not set

When to use this

Deployments, report-only CI, and security reviews validate CSP.

Edge cases

  • unsafe-inline can defeat a strict script policy.
  • A nonce must be unpredictable and match the exact script.
  • Wildcards can allow unexpected subdomains or protocols.

References