Developer Utilities

CSP Header Builder & Analyzer

Build, normalize, and inspect Content Security Policy headers for common security gaps.

What the CSP builder checks

Content Security Policy restricts where a document can load or execute resources. This tool parses semicolon-delimited directives, normalizes their values, detects duplicates, and highlights common risks such as broad script sources, data: scripts, 'unsafe-eval', or 'unsafe-inline' without a nonce or hash.

Loading tool...

Baseline directives and findings

  • default-src provides a fallback for fetch directives that are not declared explicitly.
  • object-src 'none' blocks legacy plugin content when the application does not need it.
  • base-uri limits changes to the document base URL, while frame-ancestors controls which parents may embed the page.
  • A syntactically valid policy can still break production or permit an unsafe flow. Validate required origins, nonces, hashes, workers, frames, forms, and reporting separately.

Safe deployment workflow

Begin with a least-privilege draft, deploy it as Content-Security-Policy-Report-Only, exercise real application paths, and inspect violations. Remove accidental dependencies or add the narrowest required sources, then enforce the tested policy. Keep the header under version control and re-test it when frameworks, CDNs, analytics, ads, or authentication flows change.

Related developer tools

Continue with Cache-Control Parser & Builder, cURL Builder & Fetch Converter, Cron Parser.

Cache-Control Parser & Builder

Parse, normalize, and check HTTP Cache-Control directives

cURL Builder & Fetch Converter

Build cURL requests or convert safe cURL input to JavaScript fetch

Cron Parser

Parse and explain cron expressions

How to Use CSP Header Builder & Analyzer

  1. Paste an existing policy or load a strict starting preset.
  2. Add or replace directives with the builder and copy the normalized policy.
  3. Resolve high and medium findings in the context of the real application.
  4. Deploy in Report-Only mode, test real flows, then enforce the verified policy.

Frequently Asked Questions

Can the analyzer prove that a CSP is secure?

No. It flags common static problems, but it cannot understand every application flow, browser behavior, nonce lifecycle, third-party integration, reporting endpoint, or bypass in the protected application.

Why should I start with Report-Only mode?

Content-Security-Policy-Report-Only records violations without enforcing the policy. It helps identify required resources before enforcement, although reports still need careful review and can contain sensitive URLs.

What happens to duplicate directives?

Browsers use the first occurrence and ignore later duplicate directives. The analyzer reports duplicates, and the normalized builder output keeps one explicit directive.

Sources & references

Primary references: W3C Content Security Policy Level 3; RFC 9110: HTTP Semantics.

Last reviewed: