CSP Evaluator reads a Content-Security-Policy and grades it A to F, with a pass, warn or fail line for each check. Paste the header value, a full Content-Security-Policy: line or a <meta http-equiv> tag. It flags the patterns that let cross-site scripting through a policy that looks strict: 'unsafe-inline' without a nonce, wildcard or scheme-only sources, a missing object-src, a missing base-uri, and allowlisted public CDNs.
How to read the result
Failures come first. A fail means the policy does not stop a common XSS payload; a warning means a gap in defence in depth, such as no frame-ancestors or no violation reporting. The parsed policy table shows each directive as the browser reads it, which makes typos and missing semicolons easy to spot: two directives run together appear as one unknown name.
A policy with nonces or hashes plus 'strict-dynamic' scores best, because it does not depend on an allowlist that an attacker might find a way to abuse.
Defender tips
- Move to a nonce-based policy: generate a fresh random nonce per response and add it to every script tag you serve.
- Always set
object-src 'none'andbase-uri 'none'(or'self');default-srcdoes not coverbase-uri. - Deploy changes as
Content-Security-Policy-Report-Onlyfirst, collect reports, then enforce. - Do not allowlist a whole public CDN. Anyone can publish code there, including old library versions that bypass CSP.
FAQ
Does the tool fetch my site?
No. It only reads the policy you paste. Use the HTTP Header Analyser to fetch a live site's headers.
Why is 'unsafe-inline' marked as a pass with a nonce?
Browsers that support nonces ignore 'unsafe-inline' when a nonce or hash is present; it stays only as a fallback for old browsers.
Is a grade A policy unbreakable?
No. It removes the common bypasses; script gadgets in your own code can still be abused.