Score your Content Security Policy in seconds.
Paste a Content-Security-Policy header value. The evaluator parses every
directive, flags risky keywords, surfaces missing critical directives, and returns a
0–100 score with plain-English recommendations.
Input
The header name is optional. Both Content-Security-Policy: ... and
the bare value are accepted.
Migration inputs
Provide your current CSP and (optionally) a target
CSP. Leave either blank to use a sensible default. The wizard returns 3–4 progressive
stages — Observe, Constrain, Harden, and an optional Lock down — that move from
permissive to strict without breaking production. Each stage ships as
Content-Security-Policy-Report-Only first, with a clear "Safe to
advance" condition.
What is currently in production.
If blank, a strict baseline is used.
Related reading
Background on the heuristics used by the score.
What is CSP
A clean primer for first-time CSP authors.
Security headers best practices
How CSP fits into the broader baseline of HTTP security headers.
unsafe-inline explained
Why this single token can wipe out the XSS protection CSP provides.
CSP Generator
Take the recommendations and ship a stricter policy.
CSP Diff
Compare your current policy against the new one before enforcing.
Script blocked by CSP
If the new policy breaks something, start here.
Next step
Use the score to decide what to change, then jump back into the generator or diff before you enforce anything.
Official references
Standards and guidance behind the score categories.