CSP Static Security Tools
Home / CSP Diff
Comparison tool

Diff two Content Security Policy headers.

Useful for promoting a policy from Report-Only to enforce, comparing staging vs production, or reviewing a teammate's PR. Tokens added, removed, or moved are shown per directive.

Before

After

Result

Run a comparison to see the changes.

No comparison yet.

Related reading

Patterns where a diff is the most useful tool.

Security headers best practices

The staged rollout order the diff is built around.

See the rollout order

CSP Evaluator

Score each side of the diff before shipping.

Run the evaluator

CSP Generator

Author the new value with report-only, nonce, and hash helpers.

Open the generator

CSP not working

If the new policy breaks something, start here.

Open the FAQ

Script blocked by CSP

Diagnose the most common reasons an inline script is rejected after switching policies.

Open the FAQ

CSP Checker

Verify the new value is what your live server actually returns.

Check a live URL

Next step

Once you know the delta, return to the generator or checker so the change can be validated against the live site.

Open the generator

Rebuild the policy with the exact directive set you want to ship.

Generate a policy

Check a live URL

Confirm the response header on the production page.

Verify live headers

Audit the full header set

Make sure CSP changes are aligned with the rest of the security baseline.

Audit headers

Official references

Docs that help explain why a policy diff matters.

W3C CSP Level 3

The behavior both policies are measured against.

Open the spec

MDN: Content-Security-Policy

Useful when a change adds or removes a directive token.

Read MDN

W3C Reporting API

Relevant if the diff changes a report-only rollout path.

Review reporting