Your files stay on your device

# CSP header checker

Fetch a page's Content-Security-Policy header and read it as a directive table with plain warnings on missing fallbacks and unsafe sources.

No policy checked yet
Enter a page address and press Check CSP. The report reads the header text only; it never loads the page's scripts or styles to test them.

This check reads the Content-Security-Policy header text and flags what the text alone can prove: missing default-src, unsafe-inline and unsafe-eval, bare wildcards and scheme sources, missing object-src, base-uri, and frame-ancestors, and a policy with nowhere to report violations. It cannot see whether the page's actual scripts and styles would pass the policy, and a Report-Only header is measured but not enforced by the browser. To grade a policy you paste by hand, use the CSP evaluator instead.
OptionsCheck CSP

## More web & auth tools

- [CSP evaluator & builder](/web/csp)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/csp-checker
Markdown version: https://nutter.tools/web/csp-checker.md
Plain-text version: https://nutter.tools/web/csp-checker.txt
Agent index: https://nutter.tools/llms.txt