CSP Evaluator — Check a Content Security Policy
Paste a Content-Security-Policy header or meta tag to find weaknesses: unsafe-inline, wildcards, missing object-src and base-uri, risky hosts and syntax errors.
This is a static check of the policy text. It cannot see your pages, so test the policy in report-only mode as well.
The rules follow CSP Level 3 and the strict-CSP advice of web.dev and OWASP as checked in November 2026.
| Severity | Directive | Finding |
|---|---|---|
| High | script-src | 'unsafe-inline' allows injected inline scripts and event handlers to run — the main thing CSP is meant to stop. Use nonces or hashes. |
| Medium | script-src | Allowlisted host cdnjs.cloudflare.com serves public libraries (including old AngularJS) or JSONP endpoints that can be used to bypass the policy. Prefer nonces with 'strict-dynamic', or self-host the files. |
| Medium | base-uri | Missing: an injected <base> tag could change where relative URLs point. base-uri 'self' (or 'none') has no downside for most sites. |
| Medium | object-src | default-src (used as the fallback) is not 'none'; plugin content is still allowed. Set object-src 'none'. |
| Low | frame-ancestors | Missing: other sites can frame your pages (clickjacking) unless X-Frame-Options is also sent. |
| Low | style-src | 'unsafe-inline' for styles allows CSS injection (data exfiltration through selectors, UI changes). Common, but worth removing when possible. |
| Directive | Sources |
|---|---|
| default-src | 'self' |
| script-src | 'self' 'unsafe-inline' https://cdnjs.cloudflare.com |
| img-src | * |
| style-src | 'self' 'unsafe-inline' |
A Content Security Policy only protects you if it is strict enough: one 'unsafe-inline', a wildcard or an allowlisted CDN can let attackers run scripts anyway. This evaluator reads a policy — the raw value, a full Content-Security-Policy header line or a <meta> tag — and lists its weaknesses by severity: unsafe keywords, wildcard and scheme sources, missing object-src and base-uri, hosts known for JSONP or AngularJS bypasses, deprecated directives and syntax mistakes.
How to use this tool
- Copy the policy from your server config, the browser’s Network tab, or the page’s <meta> tag.
- Paste it in; header names and meta tags are recognised.
- Fix the High findings first, then Medium.
- Re-check, then deploy in report-only mode before enforcing.
Formula
Effective script policy = script-src, or default-src when script-src is missing; object-src falls back to default-src too.
High: no script restriction, 'unsafe-inline' without nonces or hashes, wildcard/https:/data: script sources, missing object-src, missing base-uri in nonce policies. Medium: 'unsafe-eval', bypassable hosts, plain-HTTP sources, unquoted keywords, duplicate directives, header-only directives in a meta tag. Low: missing default-src or frame-ancestors, deprecated or unknown directives, short nonces.
Example
The policy script-src 'unsafe-inline' gets two High findings (inline scripts allowed; object-src missing), one Medium (no base-uri) and two Low (no default-src, no frame-ancestors). A nonce policy such as script-src 'nonce-…' 'strict-dynamic'; object-src 'none'; base-uri 'none' has no High or Medium findings.
Frequently asked questions
Why is an allowlisted CDN a problem?
Public CDNs host thousands of libraries, including old AngularJS versions and scripts with JSONP callbacks. An attacker who can inject HTML can load one of those from the allowed host and run code. Nonces with 'strict-dynamic' avoid this.
Is 'unsafe-inline' always bad?
In script-src, yes — unless a nonce or hash is present, in which case modern browsers ignore it and it only helps very old browsers. In style-src it is common and lower risk.
Is this the same as Google’s CSP Evaluator?
It applies the same kinds of checks independently and explains each finding, but it is a separate implementation. Use both, and always test in report-only mode.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/csp-evaluator/
Cite or embed this tool
kakaoCalc. (2026, November 8). CSP Evaluator — Check a Content Security Policy. https://kakao.mobile/tools/csp-evaluator/
“CSP Evaluator — Check a Content Security Policy.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/csp-evaluator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms