Security Tools

Content Security Policy (CSP) Checker

Check whether a site uses a Content-Security-Policy and see the rules it sets.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Enter a URL to see whether it sends a Content-Security-Policy header and which sources each directive allows.

What is a Content Security Policy?

A Content Security Policy (CSP) is a response header listing the sources a page may load scripts, styles, images and other content from. Anything else is blocked, which makes cross-site scripting (XSS) attacks much harder. This checker shows whether a CSP is sent and what it contains.

How to check a website's CSP

Enter the domain in the box above.
Click Check Content-Security-Policy.
Review the directives - watch for 'unsafe-inline' and wildcards (*) that weaken the policy.
Roll out a new policy with Content-Security-Policy-Report-Only first, then enforce it.

Related checks

For all security headers at once, use the Security Headers Checker.
To check framing protection too, use the X-Frame-Options Checker.

Start with Content-Security-Policy-Report-Only to see what a new policy would block before you enforce it. Once it is live, JustChecker alerts you if a deploy or plugin update quietly removes the header.

Frequently Asked Questions

Mainly cross-site scripting: if an attacker manages to inject a script, the browser refuses to run it unless it comes from a source your policy allows.

Start with Content-Security-Policy-Report-Only, which only reports violations. Fix or allow the sources your site really needs, then switch to the enforcing header.

It allows any inline script to run - including injected ones - which removes most of the protection. Move scripts into files or use nonces or hashes instead.

Share this tool:

Need a website for your business? Only $599