CSP Analyzer / Builder: Free Online Content Security Policy Checker — How-To Guide

Try it free: CSP Analyzer / Builder

A Content Security Policy (CSP) is the HTTP header that tells the browser where your site is allowed to load scripts, styles, images, and other resources from. It is one of the strongest defenses against cross-site scripting (XSS), but writing one by hand is easy to get wrong — a single unsafe-inline in the wrong directive can silently weaken the whole policy.

The CSP Analyzer / Builder is a free online tool from ToolsFam that analyzes CSP directives and flags common weaknesses like unsafe-inline, unsafe-eval, and missing defaults. Everything runs locally in your browser — no account, no upload, no waiting.

What the Tool Does

The tool takes a Content Security Policy (pasted as header text or a directive list) and runs standards-based checks against it. It highlights the directives most likely to cause security or deployment problems:

  • unsafe-inline and unsafe-eval usage — flags where inline scripts/styles or eval() are permitted, since these are the most common holes that undermine XSS protection.
  • Missing defaults — calls out absent default-src or directive gaps that leave resource types falling back to the browser's least-restrictive behavior.
  • Directive review — breaks down each directive so you can verify sources (script-src, style-src, img-src, connect-src, and the rest) against what your site actually needs.

You can run the analysis with sample input to learn the format, then paste your real policy and review the findings. When you are done, copy the result or download a text report for documentation or a code-review thread.

How to Use It, Step by Step

Step 1: Grab your policy. Open your site's response headers (browser DevTools → Network → click any page load → Headers) and copy the value of the Content-Security-Policy header. If your site does not have one yet, that is fine too — paste a draft you are planning to deploy, and the tool will help you tighten it.

Step 2: Open the tool and paste your policy. Try it free: CSP Analyzer / Builder. Paste the policy into the input area. If you have never written a CSP before, try the sample input first so you can see how a typical policy is structured.

Step 3: Run the analysis. Run the parser/checks and review the findings. Each flagged item explains what was found — for example, that script-src 'unsafe-inline' permits inline scripts, which removes the main XSS protection for scripts.

Step 4: Decide what to change. Use the findings as a to-do list: replace unsafe-inline with nonces or hashes where possible, remove unsafe-eval unless a dependency truly requires it, and add a restrictive default-src (such as default-src 'self') so anything you forgot to scope stays locked down.

Step 5: Re-test before deploying. Paste the revised policy back into the tool and re-run the checks until the flags that matter to you are gone. Then deploy behind Content-Security-Policy-Report-Only first, watch for violation reports in production, and only then enforce the policy for real.

Step 6: Save the result. Copy the analysis output or download the text report and attach it to your pull request or security review so reviewers can see exactly what changed and why.

3 Practical Tips

  1. Start with report-only mode. Deploying a strict policy straight to enforcement breaks sites fast — one missed CDN domain and your checkout stops working. The report-only header lets you collect real violation reports and tune the policy before anything breaks.

  2. Hunt down unsafe-inline in script-src specifically. Inline script allowance is the single most common reason a CSP provides almost no XSS protection. If a framework or tag manager forces it, isolate the inline scripts and move toward nonces ('nonce-<random>') or hashes ('sha256-...') as a middle step.

  3. Treat missing default-src as a bug. Without it, every directive you forgot falls back to the browser's default, which is permissive. A tight default-src 'self' is the simplest way to make sure "I forgot to list it" means "blocked" rather than "allowed".

FAQ

Q: Does the tool upload my policy or any site data?
A: No. The normal workflow runs locally in your browser — your input is never sent to a server.

Q: Is this a replacement for a production security scanner or CI check?
A: No. It is a fast local inspection tool for drafting and reviewing policies. For regulated or production changes, always verify final results with your project's own CI checks or infrastructure scanner.

Q: Can I use it if I don't have a CSP yet?
A: Yes. Paste a draft policy you are planning to deploy, or start from the sample input to learn the directive format before writing your own.

Q: Can I save the analysis?
A: Yes — copy the output to your clipboard or download a text report after running the checks.

Privacy Note

The CSP Analyzer / Builder runs 100% in the browser — your policy and any site details never leave your device.

Try it free: CSP Analyzer / Builder