# CSP evaluator (/en/docs/platform/tools/csp-evaluator)



The CSP evaluator grades a [Content Security Policy](/en/docs/web-security/policies/content-security-policy) you paste in. It is the same analysis the [CSP scanner](/en/docs/platform/tools/csp-scanner) runs, applied to a value that is not deployed yet.

Nothing is fetched and nothing is stored. There is no scan history, no result link, and no export. Close the page and the analysis is gone.

Use it while you are drafting or tightening a policy, when you want to know what a change does before it reaches a visitor.

## Evaluate a policy [#evaluate-a-policy]

1. Open **Tools** > **CSP evaluator**.
2. Paste the header **value** into the box, without the header name. For example `default-src 'self'; script-src 'self' 'report-sample'`.
3. Select **Evaluate policy**.

If the value cannot be read as a policy at all, the evaluator says so and grades nothing. Anything it can parse comes back as findings rather than an error, so a policy with mistakes still gets a score.

## What you get [#what-you-get]

**Policy score** out of 100, with the Security and Quality breakdown described on the [Tools overview](/en/docs/platform/tools), and up to five next actions.

**Findings** ranked by severity, each expanding to its recommendation, its impact, an example, the exact directives and values it flagged, and links to the reference docs.

**Parsed policy**, which is the value broken into directives and value chips, with each flagged value highlighted in its severity color. This is the fastest way to find the one token that is weakening a long policy.

## What it cannot see [#what-it-cannot-see]

The evaluator grades the policy value on its own. It has no page and no other headers, so it cannot judge anything that depends on them:

* Whether a nonce is actually unique per response, or reused across requests.
* Whether the hosts you allowlisted serve what you expect.
* Whether an [Integrity-Policy](/en/docs/web-security/policies/integrity-policy) header backs up an origin allowlist with Subresource Integrity.
* Whether a [`report-to`](/en/docs/web-security/policies/content-security-policy/directives/report-to) directive names an endpoint that the response declares, and whether that endpoint answers.

For those, deploy the policy and run the [CSP scanner](/en/docs/platform/tools/csp-scanner) or the [header scanner](/en/docs/platform/tools/security-header-scanner) against the live page. A sensible order is to draft here, ship in [`Content-Security-Policy-Report-Only`](/en/docs/web-security/policies/content-security-policy/report-only), then scan.

## Next steps [#next-steps]

* [CSP scanner](/en/docs/platform/tools/csp-scanner) to grade the policy once it is live
* [Content Security Policy reference](/en/docs/web-security/policies/content-security-policy)
* [Tools overview](/en/docs/platform/tools) for the shared score model and limits