Content Security Policy (CSP) Validator
Audit your site's Content-Security-Policy headers and <meta> directives for XSS injection vulnerabilities, wildcard sources, and unsafe inline script execution.
Instant CSP Analysis
5 of 5 free CSP checks remaining today
Daily CSP Check Limit Reached
You've used your 5 free CSP checks today. Create a free account to audit up to 500 URLs in batch with automated CI/CD runs.
Evaluating CSP headers...
Header Parser
Building Defensible Content Security Policies
A strong CSP stops Cross-Site Scripting (XSS), data exfiltration, and malicious iframe clickjacking before untrusted bytes execute.
01 // Policy Cascade Architecture
Stopping XSS with Strict Directive Cascades
The Problem:
Without an explicit
default-src 'self', any directive omitted falls back to unrestricted browser defaults. Injected scripts can connect to rogue WebSocket endpoints or exfiltrate session data via fetch.
How ScanTheThings Solves It:
Our engine audits directive inheritance across HTTP response headers and HTML <meta> tags. We verify fallback safety, detect missing frame-ancestors directives, and flag over-permissive wildcard schemes (
https:* or *) that nullify origin isolation.
POLICY VALIDATED
// AUDIT: Directive Matrix
Status
default-src
'self'
[ PASS ]
script-src
'self' https://cdn.trusted.com
[ PASS ]
style-src
'self' 'unsafe-inline'
[ HIGH RISK ]
frame-ancestors
'none'
[ ANTI-CLICKJACK ]
OWASP CSP Level: Level 3 Compliant
Generate AI Patch →
02 // Vulnerability Elimination
Eliminating Unsafe-Inline & Eval Risks
The Problem:
Teams often deploy
'unsafe-inline' or 'unsafe-eval' to get third-party analytics widgets running quickly. This single keyword allows any attacker who injects an HTML string to execute arbitrary code.
How ScanTheThings Solves It:
ScanTheThings identifies the exact inline blocks on your page and computes matching SHA-256 integrity hashes or nonces. Migrate to cryptographic script execution without refactoring third-party vendors or breaking your build pipeline.
HARDENING PATCH
HTTP Response Header Diff
Server: nginx/1.24.0
// REFACTOR
- Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval';
+ Content-Security-Policy: script-src 'self' 'nonce-rAnd0mSTT94' 'sha256-abc123...';
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
✓ Zero XSS Execution Risk
Hash Match 100%
03 // Zero-Downtime Rollouts
Safe Testing via Report-Only Deployment
The Problem:
Deploying a strict CSP directly into production often causes customer-facing outage panics: checkout payment frames fail to load, third-party authentication redirects break, and essential font assets get blocked.
How ScanTheThings Solves It:
Deploy your policy under the
Content-Security-Policy-Report-Only header. ScanTheThings validates both active and report-only configurations, inspecting live browser violation logs so you can fine-tune allowlists before turning on enforcement.
REPORT-ONLY ACTIVE
In-Flight Violation Event
User Impact: None (Telemetry Only)
// SHADOW AUDIT
!
[blocked-uri]
https://unapproved-tracker.com/collect
↳ violated-directive: connect-src
↳ original-policy: default-src 'self'
↳ disposition: report (monitored, not blocked)
Remediation: Ignore Rule or Vendor Purge
Safe to Deploy
Explore Other Audit Tools: