HTMLCSP Header Inspector
Paste a Content-Security-Policy header and get a browser-local release review: missing default-src, unsafe-inline, unsafe-eval, wildcard sources, mixed-content gaps, frame/object risk, report-only rollout notes, a copyable CSP rollout checklist, a safe verification pack with a starter Node header test, plus Apache and Nginx snippets. Nothing is uploaded.
Ctrl+Enter to run | Ctrl+K to switch tools | Recent button shows input history
Repeating this work? Turn this kind of browser utility into an API batch, MCP prompt, extension workflow, or shared team recipe.
Buy Pro Browse tool packsFAQ
What should I paste into CSP Header Inspector?
Paste a raw Content-Security-Policy or Content-Security-Policy-Report-Only header, or just the directive value. The tool parses directives and flags risky source patterns locally.
Does this replace a browser console test?
No. It is a release-readiness checklist. Test the policy in a real browser with your production pages because CSP depends on actual scripts, styles, frames, images, fonts, and third-party assets.
What is in the verification pack?
The pack includes .env.example placeholders, csp-assertions.json, and a starter verify-csp-header.mjs script. It copies directive requirements and risk checks, not raw pasted origins or report endpoints.
Should I start with report-only mode?
For existing sites, yes. Ship Content-Security-Policy-Report-Only first, review violation reports, then enforce once legitimate resources are covered.
Does this upload my policy?
No. Analysis, snippets, and verification pack generation run entirely in your browser.