CSP header parser

Reads a Content-Security-Policy value as CSP Level 3 does: every policy and directive, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only sources for scripts and plugins, missing default-src, object-src and base-uri, repeated, unknown and removed directives, and report-only mode. Nothing is fetched.

Updated 2026-10-27

What this tool checks

The value is read as CSP Level 3 reads it: a comma separates policies, a semicolon separates directives, and the first of a repeated directive wins.

Script sources: 'unsafe-inline' without a nonce or hash and 'unsafe-eval' in script-src or its default-src fallback, as CSP_UNSAFE_INLINE.
Wildcards: * and whole schemes such as https: or data: for scripts and plugins, as CSP_WILDCARD_SOURCE.
Missing directives: default-src, object-src (or its fallback) and base-uri, which does not fall back.
Typing errors: repeated, unknown and removed directives.

How to read the result

Each policy is listed with its directives and sources in lower case, as browsers compare them. A clean result means the pasted policy has none of the problems above; it does not prove that the policy fits your site.

Limitations

Nothing is fetched, so the tool cannot tell whether a site sends the header, or whether the allowed hosts can serve attacker-controlled scripts.
Nonces and hashes are recognised, not verified against your pages.

Use it from code

API reference for CSP header parser

curl -i -X POST https://api.lookproof.dev/v1/http/csp-parse \
  -H 'content-type: application/json' \
  -d '{"header": "Content-Security-Policy: default-src '"'"'self'"'"'; script-src '"'"'self'"'"' '"'"'unsafe-inline'"'"' https://cdn.example.com; object-src '"'"'none'"'"'; base-uri '"'"'self'"'"'"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Content-Security-Policy value
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

Content Security Policy (10)

Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.
Warning CSP_NO_OBJECT_SRC Plugin content (object and embed elements) is not restricted.
Info CSP_REPORT_ONLY This is a report-only policy: browsers report violations but block nothing.
Info CSP_UNKNOWN_DIRECTIVE The policy has a directive that CSP Level 3 does not define.
Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.
Warning CSP_WILDCARD_SOURCE Scripts or plugins may load from any host or from inline data.

Frequently asked questions

Can I paste the whole header line?

Yes. Content-Security-Policy: or Content-Security-Policy-Report-Only: in front of the value is recognised and removed. A report-only policy gets CSP_REPORT_ONLY: it reports violations but blocks nothing.

Why is 'unsafe-inline' not reported when I use a nonce?

Browsers that support CSP Level 2 or later ignore 'unsafe-inline' when a nonce or hash is in the same directive, so the keyword only serves old browsers. The tool follows that rule, the same way as the security headers check.

What does 'strict-dynamic' change?

With 'strict-dynamic', scripts trusted by a nonce or hash may load further scripts, and browsers ignore host and scheme sources such as https: in script-src. Wildcard sources are therefore not reported for script-src when it is present.

Does the tool fetch my site?

No. It reads only the text you paste. To see the policy a site really sends, run the security headers check.