Security
CSP Policy Inspector
Inspect a Content Security Policy string for missing directives and risky allowances like unsafe-inline.
CSP policyDirective string
CSP review
Set object-src to none unless legacy plugin content is required.
base-uri can reduce abuse of injected base tags.
Inline scripts weaken CSP protections and are best avoided.
Use this tool when
These are the practical situations where this workflow usually earns its keep.
You copied a CSP header or policy string and want to review it quickly.
You need to spot risky allowances such as unsafe-inline before a release or audit discussion.
You want a smaller findings list before taking the policy back to the frontend, platform, or security team.
Frontend and platform review
CSP inspection helps teams discuss whether the policy really matches the application’s script, style, and integration surface before a release.
Security sign-off preparation
A quick local pass creates a smaller review surface before a formal security conversation or control check begins.
Environment or migration checks
When teams move frameworks, CDNs, or embedding strategies, a CSP review helps reveal which allowances are intentional and which are legacy leftovers.
Common mistakes to avoid
These are the checks that usually keep the output useful instead of misleading.
Treating a short findings list as proof the policy is complete for every application context.
Assuming the safest-looking policy will work without testing legitimate scripts, styles, and integrations.
Only checking for unsafe-inline and ignoring the broader directive coverage around scripts, frames, and objects.
Learn how to use this tool
Inspect a Content Security Policy string for missing directives and risky allowances so teams can discuss the policy with clearer evidence.
Read the guideTell us what is missing
If this flow helped only partly, leave feedback so we can understand the missing step or edge case.
Leave feedbackRequest the next tool
Use the wishlist to suggest the next utility, workflow, or improvement that would complete this job to be done.
Open wishlistRelated tools
These tools often appear right before or right after this workflow.
HTTP Header Inspector
Review raw response headers for missing security controls, cache policy, and CORS posture.
Open toolHeader Diff Checker
Compare two raw header blocks to spot added, removed, and changed headers quickly.
Open toolCORS Policy Inspector
Inspect raw CORS response headers and flag risky origin and credential combinations.
Open tool