Free tool
CSP policy analyzer
Paste a Content-Security-Policy header and it is graded here, in this page. Every finding says what it means, why it matters and what to change — and the missing directives it reports are the ones default-src cannot answer for, not every directive you did not write.
No account, no email address, and nothing is uploaded: the analysis runs in JavaScript on this page, so your network tab stays empty while you use it.
The header name is optional — paste the whole line if that is what you have, including Content-Security-Policy-Report-Only.
Nothing to analyse yet. Paste a policy above, or load the example.
Findings
What this policy actually enforces
Fallbacks resolved. A fetch directive you did not write is still enforced if default-src is set; the four that fall back to nothing are enforced only if you wrote them.
| Directive | Sources in force | Where from |
|---|
What this cannot tell you
It reads the header and nothing else. It does not fetch your site, so it cannot tell you whether you serve this policy, whether a CDN rewrites it, or whether a page sets a second one in a <meta> tag. More to the point, a header that passes every rule here can still be blocking something you need — the vendor tag added last week, an inline handler in one old template, a font that only loads for signed-in users. That is what violation reports are for, and it is the half of the problem this page cannot do for you.
See what your policy is blocking
Point the reporting directives at HeaderHawk and the violations arrive grouped by directive, blocked source and page, with the file, line and script sample behind each group. Free for 3 sites.