Browsers block direct reads
Normal frontend code cannot read arbitrary cross-origin response headers, so a proxy is needed for URL-based checks.
Audit tool
Fetch real headers and inspect CSP coverage quickly.
Browsers do not expose arbitrary response headers cross-origin, so this page can fetch through a proxy
or let you paste headers from DevTools or curl -I for the same analysis flow.
Choose an input source
If you omit the scheme, the tool will prepend
https://.
If one proxy fails, switch providers and try again.
Use one header per line in
Header-Name: value format.
No check has been run yet.
Decode a CSP violation report
Paste the JSON payload that your browser sent to report-uri or report-to. The viewer accepts both the legacy application/csp-report shape and the modern application/reports+json batch.
Awaiting input.
No events decoded. Paste a JSON report above.
Why proxy fetching exists here
This page is designed for real-world troubleshooting, where you often need to inspect a live site quickly.
Same audit logic either way
Whether the headers are fetched remotely or pasted manually, the same header assessment logic is used.
Fallback stays simple
If the proxy path fails because of rate limits or WAF rules, switch to paste mode and continue the analysis.
Related reading
Diagnose what the audit finds and roll out a fix on your platform.
CSP not working
Troubleshooting checklist starting from the real response header and the console violation.
Debug CSP with Chrome DevTools
A focused workflow for using Network, Console, and the Issues tab to track down the cause.
Script blocked by CSP
How to tell whether the cause is an origin, inline script, nonce, hash, or unsafe-eval restriction.
What is CSP
The fundamentals: what CSP does, what it does not, and where to start.
CSP Generator
Once you know what is missing, generate the policy string you need to ship.
Security Headers Checker
Audit a full header set — not just CSP — and get fix snippets for Nginx, Cloudflare, and Next.js.
Next step
Use the live response to decide whether the fix belongs in the generator or in the broader header baseline.
Official references
Useful docs when a live response needs interpretation.