Content-Security-Policy (CSP) Builder & Auditor
Web SecurityAudit existing CSP headers for XSS bypasses, merge service presets, and export ready-to-deploy configs for Nginx, Cloudflare Pages, Vercel, and HTML.
Policy Directives (Paste CSP Header or Edit)
0 directives Score: 100/100
Generated Deployment Config
Ready HTTP Header
Security Audit Findings
0 warningsAbout This Tool
A misconfigured Content-Security-Policy header can either break legitimate third-party scripts in production or give a false sense of security while leaving trivial XSS bypasses open via unsafe-inline, unsafe-eval, or missing base-uri restrictions.
This tool parses raw CSP strings, scores the policy against web security best practices, lets you merge common service allowlists with one click, and formats the output for Nginx, Cloudflare Pages _headers, vercel.json, or HTML meta tags.
Key Features
- Live XSS Bypass Auditor: Flags unsafe-inline, unsafe-eval, wildcard origins, permissive schemes (data:, https:), and missing object-src or base-uri directives.
- One-Click Service Presets: Merge exact required origins for Google Fonts, Stripe.js, and Cloudflare Turnstile without duplicating tokens.
- Spec-Compliant HTML Meta Export: Automatically strips directives that browsers reject inside HTML <meta> tags (frame-ancestors, report-uri, sandbox).
Frequently Asked Questions
Why is frame-ancestors omitted when exporting an HTML <meta> tag?
Per the W3C Content Security Policy specification, browsers ignore frame-ancestors, report-uri, report-to, and sandbox inside <meta http-equiv="Content-Security-Policy"> elements. Those directives must be delivered via an HTTP response header.
Why does the auditor penalize script-src unsafe-inline?
Allowing unsafe-inline in script-src without a cryptographic nonce or strict-dynamic defeats the primary purpose of CSP by permitting injected inline <script> blocks and event handlers to execute.
What is the purpose of base-uri and object-src in a strict baseline policy?
Setting object-src to none blocks legacy plugin execution, and restricting base-uri to self prevents attackers from injecting a <base href="https://evil.example"> tag to hijack relative script URLs.
When should I enable Report-Only mode?
Content-Security-Policy-Report-Only instructs browsers to log policy violations to the console and reporting endpoint without blocking resources, allowing you to test a new policy in production safely before enforcing it.
