CSP Header Reviewer
Parse Content-Security-Policy directives and highlight commonly risky source expressions.
Try the tool
Private by design: tool input and output are processed within your browser. Do not paste secrets or sensitive data into any online page. No account required.
How to use this tool
Paste an HTTP CSP header value and review missing directives and wildcard or unsafe sources.
Review the result yourself before using it in an operational process or publishing it. The output is intended to be edited and checked against actual facts and applicable requirements.
Practical example
Review whether script-src contains unsafe-eval before adjusting a policy.
What this result does not establish
The parser is a lightweight review, not exploit testing or complete CSP validation. A passing heuristic check or a generated document never certifies legal, security or accessibility compliance.