About
A free, independent tool to help everyone who works on a website, not only developers, understand its Content-Security-Policy and talk about it with confidence.
Your policy stays in your browser
Everything is computed on your device. The policy you paste is never sent to a server, and there are no analytics or trackers on this site. Share links keep the policy after the # of the address, a part browsers never send to servers.
Where the information comes from
- Directive behaviour follows the W3C Content Security Policy Level 3 (opens in a new tab) specification.
- Security findings come from Google's CSP Evaluator (opens in a new tab) library (Apache-2.0), the same checks as csp-evaluator.withgoogle.com.
- What each tool needs comes from the vendor's official documentation, linked on every entry with the date it was last checked. No vendor pays to be listed or influences the results.
Help keep the catalogue right
Vendors change their requirements. If an entry is outdated or a tool is missing, open an issue (opens in a new tab) with a link to the official documentation.
This site's own policy
We follow our own advice. This site sends two policies: a header for what only a header can do (refusing to be embedded in other sites), and a <meta> tag with strict rules where scripts and styles are allowed by their exact fingerprint (hash).
Content-Security-Policy: frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; script-src 'self' 'sha256-…'; style-src 'self' 'sha256-…'">