Paste a CSP header value above and click Evaluate CSP to get an instant security grade and detailed analysis.
A+
Security Grade
Findings Summary
0
Critical
0
High
0
Medium
0
Low
0
Info
Per-Directive Analysis
Directive
Values
Status
Notes
Suggested Hardened CSP
Based on your existing CSP, here is a more secure version. Review before applying — some changes may require app updates (e.g., removing unsafe-inline requires nonces/hashes).
'
});
}
}
// ---- script-src ----
const scriptSrc = effectiveSrc(directives, 'script-src');
if (!directives['script-src']) {
if (directives['default-src']) {
issues.push({
id: 'no-script-src',
severity: 'high',
title: 'No explicit script-src (falling back to default-src)',
description: 'Best practice is to define an explicit script-src. Relying on default-src may be overly broad.',
bypass: null
});
}
}
if (scriptSrc) {
if (hasWildcard(scriptSrc)) {
issues.push({
id: 'script-src-wildcard',
severity: 'critical',
title: 'script-src allows * (wildcard)',
description: 'Wildcard in script-src allows loading scripts from any origin, completely defeating XSS protection.',
bypass: ''
});
}
if (hasValue(scriptSrc, "'unsafe-inline'")) {
const hasNonce = scriptSrc.some(v => v.startsWith("'nonce-"));
const hasHash = scriptSrc.some(v => v.startsWith("'sha256-") || v.startsWith("'sha384-") || v.startsWith("'sha512-"));
if (!hasNonce && !hasHash) {
issues.push({
id: 'script-src-unsafe-inline',
severity: 'critical',
title: "script-src contains 'unsafe-inline'",
description: "'unsafe-inline' allows execution of any inline script, enabling XSS via injected '
});
}
}
if (hasValue(scriptSrc, "'unsafe-eval'")) {
issues.push({
id: 'script-src-unsafe-eval',
severity: 'high',
title: "script-src contains 'unsafe-eval'",
description: "'unsafe-eval' permits use of eval(), setTimeout(string), setInterval(string), and new Function(string). Attackers who can inject data into these calls can execute arbitrary scripts.",
bypass: 'eval(atob("YWxlcnQoMSk="))'
});
}
if (hasScheme(scriptSrc, 'data:')) {
issues.push({
id: 'script-src-data',
severity: 'high',
title: "script-src allows 'data:' URIs",
description: "The data: scheme in script-src allows execution of base64-encoded scripts, which can be used to bypass other restrictions.",
bypass: ''
});
}
if (hasScheme(scriptSrc, 'http:')) {
issues.push({
id: 'script-src-http',
severity: 'high',
title: "script-src allows http: scheme",
description: "Allowing http: in script-src permits loading scripts over insecure connections, enabling man-in-the-middle attacks that inject malicious scripts.",
bypass: null
});
}
// Check for many domains (overly broad allowlist)
const urlSources = scriptSrc.filter(v => v.startsWith('http://') || v.startsWith('https://') || v.startsWith('//'));
if (urlSources.length >= 5) {
issues.push({
id: 'script-src-many-origins',
severity: 'medium',
title: `script-src has ${urlSources.length} allowed origins`,
description: "A large allowlist increases attack surface. Every allowed CDN or third-party domain is a potential XSS pivot if any of their served files can be influenced by an attacker. Consider using nonces or hashes instead.",
bypass: null
});
}
// Check nonce length hint (we can only inspect the declared nonce, not actual entropy)
const nonces = scriptSrc.filter(v => v.startsWith("'nonce-"));
for (const nonce of nonces) {
const b64 = nonce.slice(7, -1);
// base64: 1 char ≈ 6 bits; 128 bits = ceil(128/6) = 22 chars
if (b64.length < 22) {
issues.push({
id: 'short-nonce',
severity: 'medium',
title: 'Nonce appears to be too short (<128 bits)',
description: `Nonce "${b64}" encodes fewer than 128 bits of entropy. NIST recommends at least 128 bits to prevent guessing attacks.`,
bypass: null
});
}
}
}
// ---- object-src ----
const objectSrc = effectiveSrc(directives, 'object-src');
if (!directives['object-src']) {
const defHasNone = directives['default-src'] && hasValue(directives['default-src'], "'none'");
if (!defHasNone) {
issues.push({
id: 'no-object-src-none',
severity: 'high',
title: "Missing object-src 'none'",
description: "Without object-src 'none', plugins like Flash (legacy) or PDF viewers can be embedded. These can be used to execute scripts and bypass CSP in older browsers.",
bypass: null
});
}
} else if (!hasValue(directives['object-src'], "'none'")) {
issues.push({
id: 'object-src-not-none',
severity: 'high',
title: "object-src is not set to 'none'",
description: "object-src should be set to 'none' to block plugin-based attacks (Flash, ActiveX, PDF readers with script execution).",
bypass: null
});
}
// ---- base-uri ----
if (!directives['base-uri']) {
issues.push({
id: 'no-base-uri',
severity: 'medium',
title: 'Missing base-uri directive',
description: "Without base-uri restriction, attackers who can inject a tag can redirect all relative URLs to an attacker-controlled origin. Recommend: base-uri 'self' or base-uri 'none'.",
bypass: ''
});
}
// ---- frame-ancestors ----
if (!directives['frame-ancestors']) {
issues.push({
id: 'no-frame-ancestors',
severity: 'medium',
title: 'Missing frame-ancestors directive',
description: "Without frame-ancestors, your page can be embedded in any iframe, enabling clickjacking attacks. This directive supersedes X-Frame-Options. Recommend: frame-ancestors 'none' or 'self'.",
bypass: null
});
} else if (hasWildcard(directives['frame-ancestors'])) {
issues.push({
id: 'frame-ancestors-wildcard',
severity: 'medium',
title: "frame-ancestors allows * (any origin can embed)",
description: "A wildcard in frame-ancestors defeats clickjacking protection, allowing any site to embed your page in an iframe.",
bypass: null
});
}
// ---- form-action ----
if (!directives['form-action']) {
issues.push({
id: 'no-form-action',
severity: 'low',
title: 'Missing form-action directive',
description: "Without form-action, forms can submit to any URL. If an attacker can inject a