MSRXTools / Websites
Content Security Policy evaluator
Find the gaps in a CSP: unsafe-inline, wildcards, CDN bypasses, missing object-src, base-uri and frame-ancestors.
Runs in your browser
Loading tool…
Good to know
- Paste only the policy value, or the whole header line; the header name is stripped.
- The strongest modern pattern is a per-request nonce with 'strict-dynamic', plus object-src 'none' and base-uri 'self'.
- Roll out changes as Content-Security-Policy-Report-Only first.
Related tools
Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.Exploited vulnerabilities, last 365 days
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.Security headers analyser
Paste response headers from DevTools or curl -I and get the same header grading as the scanner, for pages we cannot reach.
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.Exploited vulnerabilities, last 365 days
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.Security headers analyser
Paste response headers from DevTools or curl -I and get the same header grading as the scanner, for pages we cannot reach.