Content Security Policy Validator
Validate your Content-Security-Policy (CSP) headers for syntax errors, security issues, and best practices compliance.
What CSP Checks
- Directive syntax validation
- Deprecated directive warnings
- Insecure value detection (wildcards, unsafe-inline, unsafe-eval)
- Missing recommended directives
- Nonce and hash format validation
CSP Best Practices
Always include default-src as a fallback, avoid unsafe-inlinewithout nonces, set object-src 'none' to prevent plugin attacks, and use frame-ancestors to control embedding.