CSP evaluator

The CSP evaluator grades a Content Security Policy you paste in. It is the same analysis the CSP scanner runs, applied to a value that is not deployed yet.

Nothing is fetched and nothing is stored. There is no scan history, no result link, and no export. Close the page and the analysis is gone.

Use it while you are drafting or tightening a policy, when you want to know what a change does before it reaches a visitor.

Evaluate a policy

1. Open Tools > CSP evaluator.
2. Paste the header value into the box, without the header name. For example default-src 'self'; script-src 'self' 'report-sample'.
3. Select Evaluate policy.

If the value cannot be read as a policy at all, the evaluator says so and grades nothing. Anything it can parse comes back as findings rather than an error, so a policy with mistakes still gets a score.

What you get

Policy score out of 100, with the Security and Quality breakdown described on the Tools overview, and up to five next actions.

Findings ranked by severity, each expanding to its recommendation, its impact, an example, the exact directives and values it flagged, and links to the reference docs.

Parsed policy, which is the value broken into directives and value chips, with each flagged value highlighted in its severity color. This is the fastest way to find the one token that is weakening a long policy.

What it cannot see

The evaluator grades the policy value on its own. It has no page and no other headers, so it cannot judge anything that depends on them:

• Whether a nonce is actually unique per response, or reused across requests.
• Whether the hosts you allowlisted serve what you expect.
• Whether an Integrity-Policy header backs up an origin allowlist with Subresource Integrity.
• Whether a report-to directive names an endpoint that the response declares, and whether that endpoint answers.

For those, deploy the policy and run the CSP scanner or the header scanner against the live page. A sensible order is to draft here, ship in Content-Security-Policy-Report-Only, then scan.

Next steps

• CSP scanner to grade the policy once it is live
• Content Security Policy reference
• Tools overview for the shared score model and limits