🛡️ built & checked locally — nothing sent anywhere
Content Security Policy Builder & Analyzer
Build a Content-Security-Policy header from a checklist, or paste an existing one to flag common risky patterns. Entirely client-side.
How it works
The builder only joins the directives you enable with the values you type into one semicolon-separated string — it doesn't validate the values themselves. The analyzer instead splits a pasted policy on semicolons, maps each directive to its list of sources, and checks that list against a short set of well-documented anti-patterns like 'unsafe-inline', 'unsafe-eval', and bare wildcards.
FAQ
Does flagging 'unsafe-inline' mean my CSP is broken?
Not broken, but weakened — it's flagged because it lets any inline <script> tag or style attribute run, which defeats most of the XSS protection a Content-Security-Policy is meant to provide.
Why does it flag a missing default-src or object-src even if I never mentioned them?
Those two checks run whether or not you pasted them — a missing default-src means any directive you forgot to set has no restriction at all, and a missing object-src leaves the legacy <object>/<embed> plugin attack surface open by default.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.