Content security policy checker
Content security policy checker reads the CSP response header for a URL. Review the policy text before assessing its directives and application behavior.
Content security policy checker: what this tool checks
Content security policy checker inspects the Content-Security-Policy response header returned by a page. It exposes the policy text so developers can confirm whether a server or content delivery configuration is sending an enforcing header. This is helpful after a deployment, hosting change, or security settings update.
How to use it
- Submit the complete URL of the page you want to inspect.
- Review whether a policy header is reported and read its directives.
- Compare the value with the intended configuration, then test application behavior and browser policy reports separately.
Understanding your results
Enabled means a nonempty enforcing header was found. It does not mean the policy is restrictive, complete, or correctly designed for the application. This check does not evaluate directive syntax, inspect CSP meta tags, or treat a report-only header as an enforcing policy.
Frequently asked questions
Does an enabled result prove protection from script attacks?
No. Policy strength depends on the actual directives and how the application handles content. A presence check cannot replace application security testing or a careful policy review.
Why can my browser show a policy that is missing here?
A page can use an HTML meta declaration, or responses can vary by request and delivery layer. This tool specifically reports the enforcing response header received during its own request.
Continue your review
Inspect all response headers using HTTP headers lookup, examine insecure references through the Mixed content checker, and review submission destinations with the Unsafe forms checker.
Share
Similar tools
HTTP headers lookup displays response header names and values for a URL. Inspect caching, redirects, server information, and security settings online.
HSTS checker reads the Strict-Transport-Security header and checks for a max-age. Review HTTPS policy signals without assuming full security validation.
Referrer policy checker reads the Referrer-Policy response header. Review its value before investigating how pages disclose referral information in requests.
Popular tools
Meta tags checker lists property-based metadata from a webpage. Inspect descriptions, robots instructions, and sharing tags before updating page settings.
DNS Lookup displays available domain records, including address, mail, and nameserver entries. Review your DNS setup and investigate website connection issues.
Website hosting checker looks up the network behind a domain address. Review provider details and understand how proxies can affect hosting information.
Ping checks whether a website responds to an HTTP request and reports available timing and status details. Investigate website availability from this service.
HTTP headers lookup displays response header names and values for a URL. Inspect caching, redirects, server information, and security settings online.
IP Lookup shows geographic information for an IP address. Review location details, understand database limits, and investigate network addresses online.