CSP Builder & Evaluator

• Builder
• Evaluator

• Builder
• Evaluator
• Start from a preset
• Strict (nonce-based)
• Balanced
• Same origin only
• Google Analytics / Tag Manager
• Directives
• Space-separated sources, e.g. 'self' https://cdn.example.com
• Upgrade insecure requests
• Report-only mode (log violations, do not block)
• New nonce
• HTTP header
• HTML meta tag
• Nginx
• Apache
• Copy
• Copied
• A meta tag cannot set frame-ancestors, report-uri or sandbox, and cannot be report-only.
• Generate a fresh nonce for every response and put it on each allowed script tag.
• Paste a Content-Security-Policy to evaluate
• Evaluate
• Load a weak example
• Policy score
• Problem
• Warning
• Note
• Good
• Paste or build a policy first.
• Findings
• No script-src or default-src: scripts are not restricted at all.
• {d} allows 'unsafe-inline', which lets injected inline scripts run. Use nonces or hashes instead.
• {d} has 'unsafe-inline' but also a nonce or hash, so modern browsers ignore 'unsafe-inline'. Fine as a fallback.
• {d} allows 'unsafe-eval', which permits eval() and similar string-to-code calls.
• {d} contains * and allows content from any host.
• {d} allows data: URLs, which attackers can use to run scripts.
• {d} allows insecure http: sources ({v}).
• {d} allows any https: host, which is very broad.
• {d} allows {v}, a shared host that is known to serve script gadgets and can enable bypasses.
• object-src is not restricted. Set object-src 'none' to block plugins.
• base-uri is missing. Set base-uri 'self' or 'none' to stop base tag injection.
• frame-ancestors is missing, so other sites can embed this page (clickjacking). Use 'self' or 'none'.
• form-action is missing, so forms can post to any site.
• Consider upgrade-insecure-requests so mixed content loads over HTTPS.
• No report-uri or report-to directive, so you will not hear about violations.
• {v} in {d} needs single quotes, otherwise it is treated as a host name.
• Unknown directive: {d}.
• The directive {d} appears more than once; only the first one is used.
• 'strict-dynamic' with a nonce or hash: a modern, strong script policy.
• default-src is 'none' or 'self': a restrictive baseline.
• object-src 'none' blocks plugins. Good.
• script-src uses nonces or hashes instead of allowing whole hosts. Good.
• The policy is empty.

• Send output to…
• Nothing to send yet.
• Received output from {tool}
• Undo
• Dismiss