CSP Evaluator

What is Content Security Policy?

Content Security Policy (CSP) is an added layer of security that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.

• XSS Prevention: Prevents unauthorized scripts from executing on your page.
• Exfiltration Control: Limits where data can be sent from the browser.
• Framing Protection: Prevents clickjacking by controlling which sites can embed yours.

Why CSP Hardening Matters

Modern web applications rely heavily on external scripts, styles, and assets. Without a robust CSP, your site is vulnerable to supply-chain attacks where a compromised third-party library could inject malicious code directly into your users' browsers.

A well-implemented CSP is one of the most effective technical controls against XSS, which remains a top priority in the OWASP Top 10 security risks.

Best Practices for CSP

Follow these security standards to ensure your policy is both restrictive and functional:

How to Use This Tool

Enter your URL and click "Analyze CSP". We retrieve your site's security headers and break down every directive. Our auditor identifies "risky" configurations like wildcards or unsafe flags and provides a security strength score. Use this report to iterate on your policy until you reach a robust 'Secure' status.