Creative Workflow Helpers
CSP Analyzer
Paste a Content-Security-Policy and instantly see risky, redundant, contradictory, and commonly misunderstood directives — with a plain-English fix for each one. Your policy never leaves the page.
Your Content-Security-Policy
live analysis
Accepts a full header, a Content-Security-Policy-Report-Only header, a
<meta http-equiv> tag, or just the directive list. Everything is analyzed locally.
Paste a CSP header, a full Content-Security-Policy, or just the directives. Analysis updates as you type.
Findings
most important firstHow it works
The policy is split into directives and source lists in your browser, then checked against
known CSP behavior: dangerous keywords such as 'unsafe-inline' and
'unsafe-eval', contradictions such as 'none' mixed with other
sources, duplicates, missing fallbacks, and directives that are silently ignored in
<meta> tags. Nothing is uploaded or logged.