About the CSP Evaluator Online Free Tool

The CSP Evaluator Online Free Tool reviews a Content-Security-Policy header string for common missing or risky directives. It summarizes directives and highlights basic security warnings.

How to Use the CSP Evaluator Online

1. Paste a CSP header value.
2. Use the sample policy if you want a known starting point.
3. Evaluate the policy.
4. Review the directive list and warning messages.

Choosing Options Correctly

Paste only the policy value, not the entire HTTP response. Evaluate both report-only and enforced policy drafts before deploying changes.

Common Use Cases

• Check whether a CSP includes object-src and frame-ancestors.
• Spot unsafe-inline or unsafe-eval usage.
• Review generated CSP output before testing in a browser.

Quick FAQ

Is this a full CSP audit?
No. It is a practical basic evaluator; complex policies still need browser testing and security review.

Can warnings be acceptable?
Sometimes. A warning means the directive deserves review in the context of your application.

Does it send my CSP anywhere?
No. The pasted policy is evaluated in the browser.

Why should I test in a browser too?
Browsers show real violations from your live scripts, styles, frames, and third-party resources.