CSP Evaluator

The CSP Evaluator lints any Content-Security-Policy header value and produces a per-directive audit with an overall score. Paste a policy — production, staging, or one you're drafting — and get an instant readout of missing directives, dangerous keywords, wildcard sources, insecure schemes, and modern-best-practice signals. It exists because CSP is famously easy to write and famously hard to write well: a single `'unsafe-inline'` in the wrong place quietly undoes the entire XSS protection you thought you had.

We check the classics — is default-src set, is script-src set, are `'unsafe-inline'` or `'unsafe-eval'` allowing arbitrary script execution, is `*` letting any origin load, is `http:` weakening HTTPS-only pages, is `data:` in script-src (a known XSS bypass), is object-src locked down, is base-uri restricted, is frame-ancestors present for clickjacking protection, is form-action limited. We also give positive credit for nonce/hash-based script sources and `upgrade-insecure-requests`, so a well-designed strict CSP visibly wins.

Use the evaluator whenever you tighten a policy, when you introduce a new third-party embed and need to figure out what broke, when a security audit flags 'missing security headers', or when you're moving from a report-only rollout to enforcement. It pairs naturally with our Security Headers Grader for the whole-response picture and with the browser's own CSP violation reports for real-world signal.