Security Tools

Content Security Policy (CSP) Checker

Check whether a website sends a Content-Security-Policy header.

Enter a domain to check whether it sends a Content-Security-Policy header.

More Security Tools

HSTS Checker X-Frame-Options Checker HTTPS Redirect Checker X-Content-Type-Options Checker Security Headers Checker Referrer-Policy Checker Mixed Content Detector Permissions-Policy Checker

JustChecker monitors your security headers continuously and alerts you if any regress.

What Is a Content Security Policy?

The Content-Security-Policy header tells the browser which sources of scripts, styles, images and frames are allowed on a page. A good CSP greatly reduces the impact of cross-site scripting (XSS). This tool checks whether a site sends a CSP and shows it.

When to Use It

When hardening a site against XSS.
When a CSP change blocks scripts or styles and you need to see the live policy.

How to Use It

Enter the domain.
Review the directives in the policy.

Understanding the Result

Key directives include default-src, script-src, style-src and frame-ancestors. 'unsafe-inline' and 'unsafe-eval' weaken protection.

Limitations

A CSP can also be set in a <meta> tag, and Content-Security-Policy-Report-Only only reports without blocking. Roll out new policies in report-only mode first.

Frequently Asked Questions

CSP primarily mitigates cross-site scripting (XSS) by restricting which sources of scripts, styles, and other resources the browser is allowed to load and execute - even if an attacker manages to inject malicious code, a strict CSP can prevent it from actually running.

Unlike a simple presence/absence header, CSP requires an accurate, maintained list of every legitimate script/style/resource source your site actually uses - too strict breaks functionality, too loose provides little real protection.

It allows inline scripts/styles directly embedded in HTML to execute, which significantly weakens CSP's core XSS protection, since that's exactly the injection vector CSP is primarily designed to block.

Yes - the Content-Security-Policy-Report-Only header lets you monitor what WOULD be blocked without actually enforcing it, letting you refine the policy safely before switching to full enforcement.

It means you're missing one specific, valuable layer of defense-in-depth against XSS - other protections (input sanitization, output encoding in your application code) still matter and function independently of CSP.

Adding any new third-party script, font, analytics tool, or embedded widget typically requires updating your CSP to explicitly allow that new source - it's an ongoing maintenance commitment, not a set-once configuration.