--- title: "CSP scanner - free Content Security Policy checker by URL" description: "Free CSP scanner: enter a URL, see the Content-Security-Policy it sends, scored 0 to 100, with a fix for every unsafe-inline, wildcard and gap. No signup." url: "https://centralcsp.com/en/tools/csp-scanner/" lang: "en" --- Tools # CSP scanner Enter a URL and we fetch its live Content-Security-Policy, score it from 0 to 100, and list prioritized fixes. ### Scan a URL Fetch a URL and inspect its Content-Security-Policy. Follow redirects Scan CSP Policy not deployed yet? [Paste it into the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) Sample result ## What a scan gives you A score out of 100, the policy exactly as your server sends it, and a fix attached to every flagged value. Run the scanner above to see your own. 59 / 100 CSP needs attention Overall CSP score ### Next actions Replace 'unsafe-inline' in script-src with a nonce or hash Remove the https: scheme from script-src and name each origin Add frame-ancestors 'self' to the policy Security How well the site resists client-side attacks. 52 /100 The configuration has security gaps to address. Quality Hygiene only: typos, duplicates, dated values. 78 /100 A few things to tidy up: dated values, duplicated directives, options that no longer match current practice. None of them weakens the site, they just make it harder to maintain. * * * Flagged values are tinted by severity. Select one to see what is wrong, the impact, and the fix to apply. content-security-policy[](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) default-src 'self' script-src 'self' 'unsafe-inline' https: cdn.example-shop.com style-src 'self' 'unsafe-inline' img-src \* block-all-mixed-content block-all-mixed-content * * * ### Findings & recommendations Issues and quality recommendations for this Content-Security-Policy. ### script-src allows 'unsafe-inline' Every inline script on the page is allowed to run, including one an attacker injects. This single keyword cancels the policy's main protection against cross-site scripting. Critical Security Critical Security Recommendation Replace 'unsafe-inline' with a nonce or a hash so only the inline code you approved executes, and add 'strict-dynamic' so trusted scripts can load their dependencies. Impact An injected inline script runs with full access to the page: session cookies, form fields and the DOM. Most XSS payloads are inline scripts, so this is the first thing an attacker tries. Example ``` script-src 'self' 'nonce-{random}' 'strict-dynamic'; ``` ### script-src allows the bare https: scheme The https: source lets the page load scripts from any HTTPS origin on the internet. The allowlist no longer lists anyone; it only requires the attacker to use TLS. High Security High Security Recommendation Remove https: from script-src and list the exact origins you load scripts from, such as cdn.example-shop.com. Impact An attacker who can inject a script tag can point it at any server they control, as long as it serves over HTTPS, and the policy will allow it. ### frame-ancestors is not defined Nothing restricts which sites may embed these pages in an iframe. default-src does not cover frame-ancestors, so the fallback does not apply here. Medium Security Medium Security Recommendation Add frame-ancestors 'self' (or 'none' if the site is never embedded) to block clickjacking overlays. Impact A hostile page can frame example-shop.com invisibly and trick a signed-in user into clicking buttons they cannot see, the classic clickjacking attack. Example ``` frame-ancestors 'self'; ``` ### block-all-mixed-content is deprecated Browsers now block active mixed content by default and the directive has been removed from the CSP specification. It adds bytes to every response without adding protection. Low Quality Low Quality Recommendation Remove block-all-mixed-content. If legacy HTTP subresources still exist, use upgrade-insecure-requests instead. Impact No security impact; this is a policy hygiene issue that dates the configuration. Wondering whether 59 is bad? [Compare a score against the sites in your sector](https://centralcsp.com/en/tools/compare/). Guide ## Understanding your CSP scan Your Content-Security-Policy tells the browser what a page is allowed to load and run, and who is allowed to embed it: scripts, styles, frames, connections and more. Our scanner fetches your URL the way a browser or a rating platform would, reads the policy your server actually sends, and grades how well it does that job. ### What does our CSP scanner check? It reads the Content-Security-Policy header your server actually returns, not the one in your config file, and grades what it finds against the way browsers enforce it: - Permissive keywords that switch the protection off, such as 'unsafe-inline', 'unsafe-eval' and 'unsafe-hashes'. - Wildcards, scheme sources and shared hosts broad enough to let anything through, such as \* or a bare https:. - Known bypasses hiding in the origins you allow: JSONP endpoints and script gadgets that turn an allowlisted host into a way around your policy. - Nonces and hashes that do not hold up: a nonce that never changes between responses, missing quotes, and values placed in a directive that ignores them. - Missing directives that leave a side door open, such as object-src, base-uri and frame-ancestors, and whether default-src really covers the ones you left out. - Deprecated and dead weight: directives the specification dropped, duplicate definitions, unknown values and separators browsers silently ignore. - The enforced and the Report-Only policy, graded separately, because a Report-Only policy blocks nothing on its own. ### How to check a website's Content-Security-Policy yourself Open DevTools and go to the Network tab, then reload the page. Select the document request, the first one, whose name matches the page URL. Read its response headers and look for Content-Security-Policy. Check for Content-Security-Policy-Report-Only in the same list: a site can send one, the other, or both, and a Report-Only header on its own enforces nothing. From a terminal, one line does the same job without opening a browser: What our scanner adds on top is the judgement: a score out of 100, findings ranked by severity with the fix beside each one, and the enforced and Report-Only policies graded separately rather than run together. ``` curl -sI https://example.com | grep -i content-security-policy ``` ### Why a weak policy matters One injected script is all it takes: stolen sessions, or a card skimmer sitting on your checkout for months. A Content-Security-Policy is the browser-side control that stops that script from running, and most of the web does not have one. Across the 761,345 sites we scanned, only 19% serve a CSP at all, and where a policy does define script-src, that directive fails our security checks 89% of the time. Shipping any policy puts you ahead; shipping a strict one puts you in a small minority. The full numbers are in the [State of the Web 2026 report](https://centralcsp.com/en/state-of-the-web/). ### How the scan works Enter a URL, get a graded report a few seconds later: a shareable link, a re-scan button for checking the fix you just deployed, and CSV or PDF exports for the ticket or the audit trail. Free, no account, and it reads only your site's public response, the same thing every visitor's browser receives. ### Scanner, evaluator, or full headers audit? CSP scanner, CSP evaluator and security headers scanner compared | | CSP scanner | CSP evaluator | Security headers scanner | | --- | --- | --- | --- | | What you give it | A live URL | A pasted policy | A live URL | | What it grades | The policy your server sends | A draft or staging policy | Every security header, with the CSP analysis inside it | | Best for | Auditing a site you or a vendor runs | Reviewing a policy before deploy | One grade for the whole header set | Use our scanner when the policy is live: it tests what your server actually sends, which is also what browsers and rating platforms see. For a draft, a staging policy or a colleague's proposal, paste it into the [CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) and get the same graded analysis without a public URL. And when you want the whole posture in one pass, HSTS, X-Content-Type-Options, Permissions-Policy, cookies and the rest, run the [security headers scanner](https://centralcsp.com/en/tools/security-headers/) instead: it scores the full header set and includes the CSP analysis as one part of it. Keep reading - [Content-Security-Policy overview](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) - [The script-src directive](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/directives/script-src) - [CSP hashes and nonces](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce) - [The Reporting-Endpoints header](https://centralcsp.com/en/docs/web-security/reporting-api/headers/reporting-endpoints) - [A CSP starter template you can copy and tighten](https://centralcsp.com/en/blog/csp-starter-template) More free tools ## Keep auditing with the other free tools Every tool is free, runs without an account, and scores with the same severity scale. ### CSP evaluator Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required. - Audit before you ship - Same scoring engine [Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) ### Security headers scanner Grade every security header a URL sends, from HSTS to Permissions-Policy, with each finding explained and prioritized. - Every header, one grade - Fix list ordered by impact [Scan your security headers](https://centralcsp.com/en/tools/security-headers/) ### Reporting API checker Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report. - Endpoint and feature mapping - Silent drops flagged [Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/) ### SRI hash generator Turn a CDN script or stylesheet URL into its Subresource Integrity hash, with a ready-to-paste tag and a CORS check. - SHA-256, 384 and 512 - CORS verified for you [Generate an SRI hash](https://centralcsp.com/en/tools/sri-hash/) ### CSP hash generator Turn an inline script or style into the hash that lets it run under a strict policy, right in your browser. - Runs entirely client-side - SHA-256, 384 and 512 [Generate a CSP hash](https://centralcsp.com/en/tools/csp-hash/) ### Website compare See where your score stands: your site beside the dataset average and the year's best-configured sites, control by control. - Published, auditable references - Radar view per category [Compare your site to the best](https://centralcsp.com/en/tools/compare/) FAQ ## Frequently asked questions Checking, scoring and fixing a Content-Security-Policy, answered. ### How do I check if a website has a Content Security Policy? Two ways. Open the browser dev tools, load the page, and look for a content-security-policy line in the response headers under the Network tab. Or paste the URL into this scanner: it fetches the page for you, shows the policy it found, including a Report-Only one, and scores it, which the dev tools will not do. ### Why does the scanner say no policy was found? Three causes cover almost every case. The header is set on some routes but not the one you scanned, which is common when a policy is added in a framework middleware that does not run everywhere. The URL redirected, and what was graded is the final response rather than the address you typed, so scan with redirects on and off and compare. Or the policy is delivered in a meta http-equiv tag inside the HTML rather than as an HTTP header, which the browser honours for most directives but which is not a response header and cannot carry frame-ancestors, report-uri or sandbox. ### Why is 'unsafe-inline' flagged as a problem? 'unsafe-inline' in script-src lets every inline script on the page run, including one an attacker injects, which is precisely what a CSP exists to stop. Most cross-site scripting payloads are inline scripts, so the keyword cancels the policy's main protection. Replace it with a nonce or a hash so only the inline code you approved executes. ### Is a Content-Security-Policy-Report-Only header enough? No. Report-Only mode sends violation reports but blocks nothing, so it protects users from nothing on its own. It is the right first step: run the policy in Report-Only, fix what it would have broken, then move it to the enforced Content-Security-Policy header. The scanner shows both headers separately so you can see exactly which mode a site is in. ### Why does my security rating say the CSP is missing when I have one? Usually because the platform observed a different response than you tested. Rating scanners can evaluate the final URL of a redirect chain, flag subdomains discovered in your footprint, or catch responses that skip the header. Scan the exact URL named in the finding, with redirects both on and off, and compare. If your fix is live, use the platform's resolve or rescan flow so its next observation records the new response. ### What is a good CSP score? On this scanner, 80 or above means a solid setup, 50 to 79 means the policy needs attention, and below 50 means critical gaps. The security axis is the one to chase: it measures resistance to real attacks, while the quality axis measures how cleanly the policy is defined. A strict policy scores high on both by allowlisting scripts with nonces or hashes and closing object-src, base-uri and frame-ancestors. ### How is this different from Google's CSP Evaluator? Google's tool grades a policy you paste into it. This scanner takes a URL and fetches the page itself, so what it grades is the header your server actually returns, which is also what browsers and security rating platforms see. It grades the enforced and Report-Only headers separately, ranks findings by severity with a fix and an example header for each, and gives you a shareable results link plus CSV or PDF export. If you want to check a policy that is not deployed yet, paste it into our CSP evaluator instead. ### Is this CSP scanner free? Yes. No account, no email, no scan quota you would notice in normal use. You can share a results link, re-scan after a deploy, and export the findings as CSV or PDF. The scan reads only your site's public response, the same thing any visitor's browser receives. ## A scan is one moment. Your CSP moves. Every deploy, tag manager change or vendor update can weaken the policy you just fixed. CentralCSP watches your Content-Security-Policy from your real visitors' browsers and tells you the moment something breaks or a new script appears. Add one header, no code changes. [Start with CentralCSP](https://app.centralcsp.com) [Build a CSP from your real traffic](https://centralcsp.com/en/platform/csp-builder/) --- Available in: [en](https://centralcsp.com/en/tools/csp-scanner/), [fr](https://centralcsp.com/fr/tools/csp-scanner/)