CSP Analyzer
Parse one CSP policy and surface fallback behavior, ignored duplicates, risky sources, and delivery-specific limits.
Paste one enforced or report-only header, or only the policy value. Multiple CSP headers should be checked separately because browsers enforce each policy independently.
Policy text report
Parsed directives and static findings will appear here.
What policy text can tell you before a browser runs it
CSP is parsed as semicolon-separated directives. When the same directive appears more than once in one policy, the first instance wins and later duplicates are ignored. That makes duplicated rules especially easy to misread during configuration reviews.
An empty source-list directive is also meaningful. For example,script-srcwith no value behaves like an empty source list and blocks matching loads; it is not the same thing as a missing directive.
Fallbacks are where otherwise reasonable policies get misread
default-srcis a fallback for fetch directives, but not forframe-ancestors,base-uri, orform-action. Script and style directives also have their own more specific fallback chains. The report calls out missing controls without pretending every site needs the same policy.
Three combinations deserve more than a quick glance
- 'none' plus another source: 'none' has no effect once another source expression is present.
- Nonce or hash plus 'unsafe-inline': supporting browsers ignore 'unsafe-inline' for the relevant script or style source list once a valid nonce or hash is present.
- 'strict-dynamic': it only becomes meaningful with a nonce or hash, and supporting browsers then ignore several host-style allowlist expressions for script loading.
Delivery method changes what a policy can do
Report-only CSP is delivered through theContent-Security-Policy-Report-Onlyresponse header. It cannot be delivered through a CSP meta element. Theframe-ancestors,report-to, andreport-uridirectives are also not supported in meta-delivered policies.
Static checks stop before application behavior starts
This page does not load your application, discover required third-party origins, validate nonce generation, test Trusted Types, or prove that a policy mitigates a particular injection path. A browser console, violation reporting, integration tests, and an application-aware security review still matter.
Parsing happens in this browser. The policy text entered here is not sent to a Yoryantra server by the analyzer.
Keep the specification beside the report
The normative parsing and fallback rules are defined in Content Security Policy Level 3. For browser-oriented examples and current compatibility notes, the MDN CSP guide is a useful companion.