Content Security Policy (CSP) Analyzer
Validate your website's Content-Security-Policy against W3C CSP Level 3 specifications. Inspect directive fallbacks, detect dangerous 'unsafe-inline' execution, verify cryptographic nonces, and score injection resistance.
What is Content Security Policy (CSP)?
Content Security Policy (CSP) is an HTTP response header that provides a declarative defense-in-depth security layer against Cross-Site Scripting (XSS), clickjacking, code injection, and data exfiltration. By instructing modern browsers which origins, scripts, stylesheets, and embedded frames are authorized to run, CSP drastically limits the harm an attacker can inflict even if an application suffers from an input sanitization failure.
Enforcing Mode
Instructs the browser to strictly block any resources or inline scripts that violate your rules. Violations trigger browser console errors and optional reports to your monitoring server.
Report-Only Mode
Permits all scripts and resources to execute normally while dispatching violation reports in the background. Used in staging to benchmark third-party dependencies before full enforcement.
Understanding the CSP Fallback Hierarchy
A common misconception in CSP engineering is that all directives inherit from default-src. Under W3C CSP Level 3, fetch directives fall back to default-src when omitted, but critical boundary directives such as base-uri, form-action, and frame-ancestors never inherit from default-src.
| Directive | Fallback Rule | Security Scope |
|---|---|---|
| script-src | Inherits default-src | Restricts sources for JavaScript execution. Inherits from default-src if absent. |
| style-src | Inherits default-src | Restricts stylesheets and style attributes. Inherits from default-src if absent. |
| img-src | Inherits default-src | Controls image loading origins. Inherits from default-src if absent. |
| connect-src | Inherits default-src | Restricts XHR, fetch(), WebSocket, and EventSource connections. Inherits from default-src. |
| object-src | Inherits default-src | Restricts <object>, <embed>, and <applet> plugins. Highly recommended to set to 'none'. |
| base-uri | Never inherits | Restricts URLs allowed in <base> tags. MUST be explicitly configured; never inherits. |
| form-action | Never inherits | Restricts targets for form submissions (<form action>). MUST be explicitly configured. |
| frame-ancestors | Never inherits | Controls which sites can embed this page in <iframe>. Never inherits from default-src. |
Modern CSP: Nonces & 'strict-dynamic'
Traditional CSP policies relied on host allowlists (e.g. script-src 'self' cdn.example.com). Empirical security research demonstrated that over 90% of host allowlists are bypassable via open redirects, CDN JSONP endpoints, or Angular library vulnerabilities. CSP Level 3 introduces nonce-based policies with 'strict-dynamic'.
Why 'unsafe-inline' is included: In CSP Level 3 browsers, presence of a nonce or hash causes the browser to automatically ignore 'unsafe-inline'. It is retained solely as a backward-compatibility fallback for older browsers that lack Level 3 support.
Common CSP Anti-Patterns & Bypasses
A poorly crafted Content Security Policy provides false reassurance while failing to prevent XSS exploits. Here are six of the most frequent misconfigurations audited by our analyzer:
Omitted 'object-src' Directive
CSP_OBJECT_SRC_MISSINGLeaving out object-src allows malicious Flash, Java applets, or PDF plugins to execute in older or legacy browser contexts, bypassing script-src restrictions.
Missing 'base-uri' Restriction
CSP_BASE_URI_MISSINGbase-uri does NOT inherit from default-src. If omitted, attackers can inject a <base href="https://attacker.com"> tag to hijack relative script imports.
Permissive Wildcard Host Sources
CSP_WILDCARD_SOURCEUsing wildcard origins like * or https:* grants unrestricted script loading, permitting any external domain to serve executable JavaScript.
Unquoted Keyword Literals
CSP_UNQUOTED_KEYWORDWriting self, none, or unsafe-inline without single quotes causes browsers to treat them as hostname endpoints (e.g., http://self) rather than special directives.
Missing 'frame-ancestors' (Clickjacking)
CSP_FRAME_ANCESTORS_MISSINGframe-ancestors does NOT fall back to default-src. Without it, third-party sites can embed your application in an iframe for UI redressing attacks.
Active 'unsafe-eval' in Production
CSP_UNSAFE_EVAL_USAGEEnabling 'unsafe-eval' permits window.eval(), Function(), and setTimeout(string), dramatically increasing the blast radius of injection flaws.
How to Roll Out a Strict CSP Without Breaking Production
Deploying an aggressive CSP overnight will inevitably break third-party analytics, chat widgets, or inline tag managers. Follow this staged production rollout protocol:
Phase 1: Asset & Script Inventory
Catalog all external script sources, CDNs, analytics providers, and third-party widgets across all application routes.
Phase 2: Deploy Report-Only Header
Publish Content-Security-Policy-Report-Only with a report-uri or report-to endpoint. Collect telemetry across real browser traffic for 7 to 14 days.
Phase 3: Refactor Inline Scripts to Nonces
Replace raw inline <script> tags and onclick handlers with server-generated cryptographic nonces or external modular JS files.
Phase 4: Enforce Strict CSP
Switch the response header name to Content-Security-Policy. Block unauthorized resources while maintaining telemetry reporting.
Phase 5: Automated CI/CD Regression Verification
Integrate SiteSecura's CSP analyzer into your CI pipeline to prevent new pull requests from introducing permissive wildcards or unsafe keywords.
Frequently Asked Questions
Detailed answers covering W3C specifications, bypass scenarios, report endpoints, and nonce implementation.
Explore More Standalone Security Tools
Inspect HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers.
Verify RFC 9116 compliance, PGP keys, contact channels, and expiration timestamps.
Validate RFC 9309 crawler directives and XML sitemaps with longest-match simulator.
Complete Perimeter Website Security Audit
Scan your website across SSL/TLS certificates, DNSSEC, email security (SPF, DKIM, DMARC), security headers, and open ports in under 60 seconds.