Tools / CSP evaluator
Content Security Policy evaluator
Inspect the enforced CSP response header and flag common risky source expressions or missing defensive directives.
Common checks
- Script sources and use of
'unsafe-inline','unsafe-eval', or wildcards. object-src,base-uri,form-action, andframe-ancestors.
This is a heuristic policy review, not an XSS test or proof of security. CSP Report-Only headers are not enforced and are not treated as an active policy.