Next-Gen App & Browser Testing Cloud
Trusted by 2 Mn+ QAs & Devs to accelerate their release cycles
Free CSP Validator Online
Check a Content-Security-Policy in your browser with this free CSP validator. Paste a header, load a sample, and review directive findings, a score, and hardening notes without uploading the policy.
Categories
Header value, full line, or meta tag.
CSP 3 nonce and strict-dynamic rules.
Validate CSP
Click Validate CSP.
What is a CSP validator?
A CSP validator is a browser tool that parses a Content-Security-Policy and reports syntax problems, missing directives, and sources that weaken XSS defense. You paste the header value, or a meta http-equiv tag, click Validate, and read a score with findings. The checks follow Content Security Policy Level 3 from W3C.
TestMu AI maintains this CSP validator for testers who review headers before a release. All processing happens in your browser. No data is uploaded. Pair the report with the HTTP Status Code Checker when you need to confirm the live response still sends the header you reviewed.
Why does Content-Security-Policy validation matter?
A header that looks complete can still fail as XSS mitigation. Validation walks each directive the way a browser will apply it, so you see wildcards, missing fallbacks, and ignored keywords before users do.
- Unsafe keywords: unsafe-inline and unsafe-eval reopen the exact script paths CSP is meant to close.
- Missing fallbacks: object-src and base-uri have no useful default when you rely on nonces or hashes.
- Host allowlists: popular CDNs can host JSONP or old libraries that bypass a script-src list.
- Report-Only rehearsal: a draft policy can log violations first, then move to the enforcing header.
- Browser differences: CSP 2 and CSP 3 treat strict-dynamic and unsafe-inline differently after a nonce.
How do you use this CSP validator?
The widget stays on this page. Paste a policy, pick the CSP version you care about, and read the score beside the findings table.
- Paste the policy: Enter the Content-Security-Policy value, the full header line, or an HTML meta tag in the input box.
- Choose a CSP version: Keep CSP 3 unless you need to see how CSP 2 treats nonces, hashes, and strict-dynamic.
- Click Validate: Run the check in your browser. Use Sample to load a weak policy if you want to see findings first.
- Review the report: Read the score, severity list, and parsed directives. Copy or download the text report when you need a record.
What are the features of this CSP validator?
The checker is built for header review during pull requests and release checks. It covers the same review points teams already walk by hand.
- Local parsing: The policy never leaves the page, including Sample, Upload, and Load from URL flows.
- Severity findings: High, medium, low, and info rows name the directive and the bypass or gap.
- Score and grade: A 0 to 100 score summarizes how many weak sources and missing directives remain.
- CSP 2 and CSP 3: The version control shows which sources a given user agent will ignore.
- Exportable report: Copy or download the text report for tickets, code review, or a security backlog.
What are common CSP validator use cases?
Testers, appsec reviewers, and frontend teams use a CSP checker when a header change is about to ship. These are the jobs that show up most often.
- Release review: Paste the candidate header from nginx, Apache, or a meta tag before it reaches production.
- XSS hardening: Confirm script-src is not still carrying unsafe-inline after a nonce rollout.
- Header pairing: Check CSP beside TLS setup with the SSL Certificate Checker and CORS rules in the CORS Tester.
- Auth token work: After you inspect a session token in the JWT Decoder, confirm script-src still blocks injected handlers.
- Server config drafts: Review a policy you generated next to an htaccess Generator snippet before you reload Apache.
After the header looks sound, load the page on the Real Device Cloud and watch the console on 10,000+ real devices and 3000+ browsers. Track leftover violations in Test Manager the same way you track other release checks.
What is the difference between Content-Security-Policy and Report-Only?
Both headers use the same directive language. The difference is whether the browser blocks a violation or only reports it. The OWASP CSP cheat sheet recommends Report-Only while you tune a new policy.
| Content-Security-Policy | Content-Security-Policy-Report-Only |
|---|---|
| Enforces the policy and blocks violating requests. | Logs violations and still loads the blocked resource. |
| Use when the allowlist is known to match the page. | Use while you collect reports and fix false positives. |
| A bad directive can break scripts, styles, or frames. | A bad directive stays visible in reports without taking the page down. |
Frequently Asked Questions (FAQs)
What does a Content-Security-Policy header do?
A Content-Security-Policy header tells the browser which scripts, styles, images, and other resources a page may load. The browser blocks anything outside that allowlist, which limits XSS even if markup is compromised. Content Security Policy Level 3 defines the header syntax and the fetch, document, navigation, and reporting directives.
Why is unsafe-inline a problem in script-src?
The unsafe-inline keyword lets any inline script or event handler run. An injected script tag then executes because the browser cannot tell your inline code from an attacker payload. A nonce or hash allowlist keeps specific inline scripts and blocks the rest. The OWASP CSP cheat sheet treats unsafe-inline as a last resort.
Which CSP directives should every policy include?
Every policy should set script-src or default-src, set object-src to none, and set base-uri to none or self. Add frame-ancestors to block unexpected embedding and form-action to limit form targets. A nonce or hash on script-src, plus strict-dynamic when trusted scripts load more scripts, is the current hardening path.
Can I validate a CSP before deploying it?
Yes. Paste a draft header, a Report-Only header, or a meta tag before you ship it. The validator checks syntax and unsafe sources without talking to your server. Teams often run Report-Only in production first, collect violations, then switch to the enforcing header once the report stream is clean.
Does this CSP validator upload my policy?
No. All processing happens in your browser. No data is uploaded. Load from URL only fetches a file you name, and that request stays in your session. You can review policies from pull requests or local configs without creating an account.
What is a nonce in a Content-Security-Policy?
A nonce is a per-response random value placed in script-src as a nonce source and on matching script tags. The browser runs only scripts that carry that nonce. Generate a new nonce on every response and keep it at least eight characters from a base64 charset so it cannot be guessed.
How is a CSP score calculated?
The score starts at 100 and subtracts points for each finding. High issues such as missing script-src or a wildcard in script-src cost more than informational notes such as a missing report-uri. The grade is a guide for review, not a proof that the site is safe.
What is strict-dynamic used for?
The strict-dynamic keyword lets a nonce or hash trusted script load additional scripts without listing every host. Host allowlists, unsafe-inline, and self are ignored for that directive in CSP 3 once strict-dynamic is present. Use it with a nonce or hash, not as a stand-alone source.
Did you find this page helpful?
More Tools
TestMu AI forEnterprise
Get access to solutions built on Enterprise
grade security, privacy, & compliance
- Advanced access controls
- Advanced data retention rules
- Advanced Local Testing
- Premium Support options
- Early access to beta features
- Private Slack Channel
- Unlimited Manual Accessibility DevTools Tests