Test a Content Security Policy
A Content Security Policy tells the browser which sources of scripts, styles, and other content to trust, and it's a strong defence against cross-site scripting. But CSPs are easy to get wrong — too loose and they don't protect, too strict and they break the page. This tool helps you check and validate a policy before you rely on it.
How to use it
- Paste or build your Content Security Policy.
- Review how it parses and what it allows or blocks.
- Adjust the directives and re-check.
Where it helps
- Validating a policy before deploying it.
- Understanding why a resource is being blocked.
- Tightening a loose policy without breaking the site.
Questions people ask
Why is my inline script blocked? A strict policy blocks inline scripts by default; move them to files or use the policy's allowance mechanisms.
Is my input uploaded? No — the analysis runs in your browser.