CSP Analyzer

CSP Analyzer — Content-Security-Policy Check Online

101IP parses the Content-Security-Policy header from any website: displays all directives, highlights dangerous configurations, and grades the policy from A+ to F.

What is checked

• 'unsafe-inline' — allows inline scripts and styles, the main XSS vector;
• 'unsafe-eval' — allows eval() and dynamic code execution;
• Wildcard * — allows loading resources from any host;
• data: URI — may be exploited to load malicious content;
• http: scheme — insecure HTTP sources on an HTTPS site;
• Missing directives — default-src, object-src, base-uri, frame-ancestors.

Grade scale

• A+ / A — strict policy, no critical issues;
• B / C — some weaknesses, improvements recommended;
• D / F — critical vulnerabilities, CSP provides little protection.

Frequently Asked Questions

• What is 'unsafe-inline' in CSP and how dangerous is it?

  The 'unsafe-inline' directive allows execution of any inline scripts and styles. This is extremely dangerous because an attacker can inject malicious code through an XSS vulnerability. Instead, it is recommended to use strict nonces or hashes for individual scripts, which allow only verified inline content.

• How should I interpret a grade of F from CSP Analyzer?

  A grade of F means the policy is absent or contains critical vulnerabilities — for example, default-src * or both unsafe-inline and unsafe-eval are permitted. You should immediately configure a CSP header that restricts scripts to trusted sources only and uses nonces or hashes for any inline content.

• Why is my CSP blocking Google Analytics?

  Most likely your script-src directive does not include the Google Analytics domains (e.g. www.googletagmanager.com). Add those domains to your allowed sources. CSP Analyzer will show which scripts are blocked so you can adjust the directive and restore analytics without weakening the overall policy.