CSP analyzer

Content-Security-Policy is the rule card a server sends along with every answer: which sources per type — script, style, img, frame — may load. This tool retrieves that card through our server and reads it directive by directive: every enforced header and every report-only header separately, because report-only reports without refusing.

The tool measures what the policy allows, not what loads: unsafe-inline without a nonce or hash, unsafe-eval, data: scripts, wildcards as * or *.cdn.com, http: sources and framing standing wide open. A frame-ancestors on * is a fault; the absence of any framing rule is a warning — and X-Frame-Options alone is heritage, reported as heritage.

Border named: we measure the headers of the final answer after the redirects. We visit no subresources — a source says what may load — and a policy that is only placed by the page’s own JavaScript does not stand in the header and is not seen.