CSP Inspector
Paste one Content-Security-Policy value to inspect its directives, source tokens and fallback chains. See which duplicate occurrence applies, distinguish enforcing from report-only context, and copy or download a readable local report without sending the policy to a server.
One header value, up to 32 KiB of UTF-8 text. Keep single quotes around keywords, nonces and hashes. Ctrl or ⌘ + Enter to inspect.
behind the header.
Trace the first effective occurrence, inspect source syntax and see where each fetch directive falls back.
Example policy. Inspect it or replace it with your own header value.
Trace a concrete rule
Reference: Content Security Policy Level 3. Browsers and later specification drafts can differ. Nonce values, digests, endpoint delivery and application behavior are not tested.
Accuracy. Inspects one supplied CSP policy up to 32 KiB of UTF-8 text using static directive, token and fallback rules. It does not fetch a site, execute the policy, verify nonces or hashes, test browser support, or certify security or compliance.
Common questions
- What should I paste into the CSP evaluator?
- Paste one policy value, such as default-src 'self'; img-src 'self' https://images.example. Leave out the Content-Security-Policy header name and colon, then select Enforcing or Report-only to match the header you are inspecting. Inputs are limited to 32,768 UTF-8 bytes and are never silently truncated.
- Which occurrence of a duplicate CSP directive applies?
- The first occurrence of a directive in one policy applies. Later occurrences are ignored rather than merged. This also applies when the first source list is empty: img-src; img-src * keeps the first empty list. The table retains every occurrence and labels the ignored duplicates.
- Does default-src apply to every directive?
- No. The fallback table shows the known fetch-directive chains. For example, worker-src falls back through child-src, script-src and default-src. base-uri, form-action and frame-ancestors do not fall back to default-src. An explicit directive, including one with an empty list, stops the fallback chain.
- Are nonce and hash values preserved?
- Yes. The inspector retains the spelling and case of source tokens, including quoted nonce and SHA-256, SHA-384 or SHA-512 hash sources. It checks their recognized token syntax but does not decode or verify a digest, inspect your HTML, or determine whether a nonce is unpredictable or reused.
- What does report-only mode change?
- A Content-Security-Policy-Report-Only policy does not enforce restrictions. It can report violations when reporting is configured and supported. The inspector labels this context and explains directives such as sandbox that do not apply there. It does not contact a reporting endpoint or verify receipt.
- Can this tool certify that my site is secure?
- No. These are static syntax and behavior notes for the policy you supply. The tool does not fetch the site, test requests, inspect application code, check every browser version or grade security or compliance. No listed issue does not establish that the policy meets your application's needs.
- Can I inspect multiple policies together?
- Inspect each policy separately. This tool refuses comma-separated policy lists instead of combining them. Multiple enforcing policies apply together, so a resource must meet each applicable policy; their source lists are not combined into one larger allowance.
- Is my policy saved or uploaded?
- The text and analysis stay in the current browser page. This tool makes no network request for inspection and does not save the policy to local storage. Copy report uses your browser clipboard only after you select it.
Inspects one supplied CSP policy up to 32 KiB of UTF-8 text using static directive, token and fallback rules. It does not fetch a site, execute the policy, verify nonces or hashes, test browser support, or certify security or compliance.