CSP Checker
Parse and validate your site's Content-Security-Policy.
Content Security Policy (CSP) Checker
Analyze a website's CSP header to see which sources of content (scripts, images, styles) are permitted and detect potential XSS vulnerabilities.
Enter a URL above to inspect and validate its Content Security Policy configuration.
What is a Content Security Policy?
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks.
By adding a CSP header to your web server's responses, you explicitly whitelist the domains that the browser should consider to be valid sources of executable scripts, stylesheets, fonts, and images.
Common CSP Directives
default-src: Serves as a fallback for the other fetch directives.script-src: Specifies valid sources for JavaScript.style-src: Specifies valid sources for stylesheets.img-src: Specifies valid sources of images and favicons.connect-src: Restricts the URLs which can be loaded using script interfaces (like fetch, XHR, WebSockets).
Related Guides
Deepen your understanding with our expert articles.