CSP analyzer
Paste a Content-Security-Policy and get a critical read, directive by directive: what it protects, what only pretends to, and what is missing.
F
1 critical
5 warnings · 2 ok
6 directives read
6 directives read
- script-src allows 'unsafe-inline' — injected HTML runs as script. In practice this disables the CSP against XSS; use nonces or hashes.
- script-src trusts *.googleapis.com — a host wildcard opens a bypass if any subdomain serves JSONP or controllable content.
- object-src missing and default-src isn't 'none' — plugins inherit the allowlist.
- base-uri missing — an injected <base> reroutes every relative URL.
- style-src allows 'unsafe-inline' — acceptable, but opens style injection and CSS-based exfiltration.
- img-src is * — a fully open origin for that resource type.
- frame-ancestors restricted — clickjacking blocked.
- upgrade-insecure-requests present — http:// requests are promoted to https://.
- form-action missing — forms can submit to any destination.
directive by directive
| directive | value | read |
|---|---|---|
| default-src | 'self' | ✓ solid |
| script-src | 'self' 'unsafe-inline' https://cdn.example.com *.googleapis.com | ✗ bypassable |
| style-src | 'self' 'unsafe-inline' | ▲ could be tighter |
| img-src | * | ▲ could be tighter |
| frame-ancestors | 'none' | ✓ solid |
| upgrade-insecure-requests | (sem valor) | ✓ solid |
| object-src | — missing — | ∅ recommended: 'none' |
| base-uri | — missing — | ∅ recommended: 'none' |
| form-action | — missing — | ∅ recommended: 'self' |
Heuristics: CSP Level 3 + well-known public bypasses. Not a full normative validator.
🔒 100% in-browser. No data is ever sent to any server.
← Back to tools