CSP Evaluator
Paste a Content-Security-Policy or fetch it from a URL. The evaluator checks it against the CSP Level 3 specification and grades it A+ to F, with a fix for each finding.
Start a check
- Pasted policies stay in your browser
- CSP Level 3
Paste
Evaluate a Content-Security-Policy
Paste the header value, a full Content-Security-Policy header line or a <meta> tag. Nothing leaves your browser.
Introducing Vigilbase OS
The cybersecurity operating system.
Connect the security tools you already pay for. Spin up personalised dashboards in minutes, with every log and event auditable and queryable in one place.
one.vigilbase.com/acme.examplePreview · sample data
Acme Security OS
events | where severity >= medium | last 24hVigil agentWorking
- Investigate Credential-stuffing burst against /login
- Fix Rate-limit rule deployed at the edge
- Verify Attack traffic down 98% in five minutes
What is a CSP evaluator?
A CSP evaluator reads a Content-Security-Policy and reports how well it limits cross-site scripting (XSS): whether scripts are restricted to code you trust, whether 'unsafe-inline', 'unsafe-eval' or wildcards reopen the door, and whether the directives that do not fall back to default-src (base-uri, form-action and frame-ancestors) are set. Vigilbase evaluates a pasted policy in your browser and does not send it anywhere.
What the CSP evaluator checks
The evaluator parses the policy the way CSP Level 3 browsers do, then checks how it treats scripts and the directives that have no fallback.
Script sources
The directive that governs scripts: script-src-elem, then script-src, then default-src. 'unsafe-inline' without a nonce or hash, a wildcard, a whole scheme such as https: or data:, and plain http:// hosts all let injected script run.
Nonces, hashes and 'strict-dynamic'
The strict CSP that the CSP Level 3 specification describes allows scripts by nonce or hash together with 'strict-dynamic', and sets base-uri to 'self' or 'none'. A nonce should be at least 128 bits and new for every response.
'unsafe-eval'
Lets text run as code through eval(), new Function() and similar calls. 'wasm-unsafe-eval' covers WebAssembly without it.
object-src
Controls plugin content in <object> and <embed>. object-src 'none' is the usual setting.
base-uri, form-action and frame-ancestors
These do not fall back to default-src, so each needs its own directive. frame-ancestors replaces X-Frame-Options and cannot be set in a <meta> tag.
Reporting
report-to, with report-uri as a fallback for older browsers, tells you what the policy blocks.
Syntax
Unknown or duplicate directives, keywords without quotes and values outside the source grammar have no effect, so a typo can silently weaken a policy.
How the A+ to F grade works
Each finding removes points: 50 when scripts are not restricted at all, 25 for a high-severity finding, 10 for medium and 5 for low. Notes cost nothing. When a response sends several policies, browsers enforce all of them, so a script weakness counts only if every policy allows it.
- A+
- 95-100
- A
- 85-94
- B
- 70-84
- C
- 55-69
- D
- 40-54
- F
- 0-39
Related checks and next steps
- CSP Generator
Build a nonce-, hash- or allowlist-based policy with server snippets.
- HTTP Security Headers Checker
Grade CSP, HSTS, X-Frame-Options and seven more response headers.
- HSTS Checker
Check Strict-Transport-Security and HSTS preload eligibility.
- A practical website protection guide
Where a CSP fits next to a WAF, DDoS protection and patching.
Managed Cloudflare
Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.
Explore Managed CloudflareManaged SOC
Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.
Explore Managed SOCSources
Questions
CSP evaluator FAQ
What does the CSP evaluator check?
It parses each directive the way CSP Level 3 browsers do and checks how scripts are allowed ('unsafe-inline', 'unsafe-eval', wildcards, schemes, host allowlists, nonces, hashes and 'strict-dynamic'), whether object-src, base-uri, frame-ancestors and form-action are set, whether violations are reported, and whether any directive or value is malformed.HTTP Security Headers CheckerA practical website protection guide
Is my policy sent to Vigilbase?
Not when you paste it: parsing and grading run in your browser. When you fetch a policy from a URL, the Security Headers scanner requests that URL and saves the scan result, including the response headers, behind a shareable link.Privacy and data handlingHTTP Security Headers Checker
What is a strict CSP?
The CSP Level 3 specification describes a strict CSP as script-src with only nonces or hashes plus 'strict-dynamic', and base-uri 'self' or 'none', for example: script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'. The evaluator marks a policy strict when scripts and inline event handlers can run only by nonce or hash (or not at all), eval() is blocked and base-uri is 'self' or 'none'. Allowlist policies that name hosts can often be bypassed through scripts already hosted on those origins.A practical website protection guide
Why is 'unsafe-inline' flagged when my site needs inline scripts?
Because it lets any injected inline script run as well as yours. Give your own inline scripts a per-response nonce, or list their hashes. Browsers that support nonces and hashes then ignore 'unsafe-inline', so you can keep it only as a fallback for very old browsers.A practical website protection guide
Does frame-ancestors work in a meta tag?
No. CSP Level 3 does not support frame-ancestors, report-uri or sandbox in a <meta> policy, and a Report-Only policy cannot be delivered in a meta tag at all. Send them in the HTTP response header.
How is this different from the Security Headers Checker?
The Security Headers Checker grades ten response headers, with Content-Security-Policy worth 20 of its 100 points. The CSP evaluator looks only at the policy, directive by directive, and explains each finding.HTTP Security Headers CheckerCompare the public security checks