CSP Checker
Check an existing Content-Security-Policy for weaknesses and mistakes. Free, and runs entirely in your browser — nothing you enter is uploaded or stored.
About CSP Generator
Builds a Content-Security-Policy from the directives you fill in, or takes an existing one apart, and writes it the way your server or framework sets it: a raw header, a meta tag, nginx, Apache, Caddy, IIS, Express with helmet, Next.js, Netlify or Cloudflare _headers, a Cloudflare Worker, FastAPI, Django, ASP.NET Core or Spring Security.
Every policy is checked, not just written. A policy can be syntactically perfect and stop nothing. The checks are the ones that separate the two: 'unsafe-inline' in script-src with no nonce, a wildcard or bare https: source for scripts, CDNs that serve anybody's JavaScript, a missing object-src or base-uri, and directives that are silently ignored in a meta tag.
Keywords are quoted for you. self without its quotes is a host named self as far as a browser is concerned; this is the most common reason a hand-written policy blocks the site it was written for. Bare keywords, nonces and hashes are quoted, quoted hosts are unquoted, and each correction is listed.
The nonce option writes the strict CSP recipe Google recommends: a per-response nonce plus 'strict-dynamic', so only scripts carrying the nonce — and whatever they load — run. The nonce appears as a {RANDOM} placeholder because it has to be generated fresh by the server on every response.
Where it helps
- Writes one policy for fourteen servers and frameworks, including the quoting each config language needs.
- Checks what the policy actually allows, including the effective script-src when only default-src is set.
- Quotes keywords and unquotes hosts, the two mistakes that make a hand-written policy break the site.
- Offers report-only mode, the safe way to roll out a policy without breaking the page.
- Writes the strict nonce + 'strict-dynamic' recipe rather than a long allowlist of hosts.
- Runs in the browser — a policy says a lot about a site's architecture, and this one is not sent anywhere.
Limits
- It cannot see your pages, so it cannot tell you which inline scripts or third-party hosts they actually need — run in report-only mode to find out.
- The nonce is a placeholder: the server has to generate it and add it to each script tag, which no configuration file can do on its own.
- Hash sources for inline scripts have to be computed from the exact script text and are not generated here.
- Findings follow current browser behaviour; very old browsers ignore 'strict-dynamic' and nonces and fall back to the rest of the list.
Frequently asked questions
Why does my policy block my own site?
Usually one of three reasons: a keyword such as self written without quotes, which the browser reads as a host name; inline scripts or styles, which a policy without 'unsafe-inline' or a nonce blocks; or a third-party host missing from the list. Report-only mode shows every violation in the console without blocking anything.
Should I use a nonce or a list of allowed hosts?
A nonce. Allowlists are long, break when a vendor changes CDN, and are routinely bypassed through JSONP endpoints and old libraries on the allowed hosts. A nonce with 'strict-dynamic' trusts only the scripts your server marked on this response and whatever they load.
Why is frame-ancestors ignored?
Because the policy is delivered in a meta tag. frame-ancestors, report-uri, report-to and sandbox only work as an HTTP header — a page cannot protect itself from being framed with markup inside the frame.
What does report-only do?
It sends Content-Security-Policy-Report-Only instead: the browser evaluates the policy and reports every violation, to the console and to report-to if set, but blocks nothing. Run it for a while, fix what it reports, then switch to enforcing.
Related tools
- CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
- cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
- HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- HTML Formatter — Indent and tidy HTML markup
- CSS Formatter — Format stylesheets with consistent indentation
More Web Development tools
- HTML Formatter — Indent and tidy HTML markup
- CSS Formatter — Format stylesheets with consistent indentation
- JavaScript Formatter — Re-indent JavaScript and TypeScript source
- SCSS/SASS Formatter — Format SCSS syntax and nested rules
- TypeScript Formatter — Format TypeScript source code
- SQL Formatter — Format SQL statements with dialect selection
- SQL Minifier — Collapse formatted SQL into compact text
- CSS Unit Converter — px, rem, em, percentages and viewport units, with a preview
- Query String Parser and Builder — Convert query strings into editable key-value data
- CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
- CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
- cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
- Minifier — Shrink CSS, HTML or JavaScript
- Flexbox Playground — Try every flex property and read the CSS back
- CSS Grid Playground — Build a grid template and see the tracks it makes
- Responsive Viewport Tester — Render your markup at phone, tablet and desktop widths
- SVG Path Viewer — Draw path data and read back what it contains
- SVG to CSS Converter — Turn an SVG into a data URI for CSS or an img tag
- OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
- Regex Tester — Test patterns, inspect groups and preview replacements
- User-Agent Parser — Identify the browser, engine, operating system and device behind a User-Agent string
- HTTP Status Codes — Look up what a status code means, when to send it, and whether it is cached or safe to retry
- HTML to JSX — Convert HTML and SVG markup into JSX for React, with styles, attributes and whitespace handled
- Semver Checker — Test versions against npm ranges, sort them by precedence, and see what each bump produces
- Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework