Using the analyzer
Paste the Content-Security-Policy header value as returned by the server. The parser highlights broad sources, eval, inline JavaScript, and missing base or frame restrictions.
SIXHACK / WEB
CSP Analyzer
Analyze Content Security Policy headers
Parse CSP policies, flag risky patterns, and review actionable recommendations.
⬡CSP · XSS · Headers
INPUT / 01
Input
OUTPUT / 02
Results
Results will appear here after processing the input.
HOW IT WORKS / GUIDE
Interpreting the results
Not every warning is exploitable
Allowing unsafe-inline does not prove XSS. Actual impact depends on nonces, hashes, strict-dynamic, browser support and the rest of the application controls.
Validate in the browser
Review the effective policy, consider Content-Security-Policy-Report-Only, and test real application flows before enforcing stricter restrictions.
NEXT / TOOLS