CSP Source Tester

How to use

1. 1Paste your Content-Security-Policy header value into the policy textarea. Use one of the sample policies (Strict starter, Nonce + strict-dynamic, Inline hash, Wildcard hosts, Frame ancestors) to see the matching rules in action.
2. 2Set the page origin to the origin of the protected page (for example https://app.example.com). This drives 'self' matching and the default scheme for host-sources with no scheme part.
3. 3Add each resource you want to test. Choose the request type (external script, image, fetch, iframe, frame ancestor, and so on), then either paste the resource URL or, for scripts and styles, switch on Inline content and paste the body (and the nonce attribute when relevant).
4. 4Read each verdict card. Allowed cards name the matched source expression and explain why it matched. Blocked cards name the closest near-miss and the directive that owns the decision.
5. 5Use Copy report to grab a plain-text summary suitable for a pull request, an audit document, or a Slack thread. Use the resolved directives table to confirm the fallback chain for each resource type.

About this tool

CSP Source Tester evaluates whether a Content-Security-Policy would allow or block a list of resources from loading on a protected page. Paste the policy header value (with or without the Content-Security-Policy: prefix), set the page origin, then add the resources you want to check. For each resource you choose a request type (external script, inline script body, style element, inline style attribute, image, font, fetch or XHR, iframe source, media, plugin object, manifest, worker, prefetch, form action, or frame ancestor) and a URL or inline body. The tester resolves the governing directive using the W3C CSP Level 3 fallback chain (script-src-elem and script-src-attr fall back to script-src and then default-src; style-src-elem and style-src-attr fall back to style-src and then default-src; worker-src walks worker-src, child-src, script-src, default-src; form-action and frame-ancestors do not fall back to default-src) and runs the documented URL source-list matching algorithm against every source expression in the resolved directive. Keyword sources are recognized: 'none' blocks the directive entirely; 'self' matches the page origin with the documented scheme upgrade for https and wss; 'unsafe-inline', 'unsafe-eval', 'wasm-unsafe-eval', 'strict-dynamic', 'unsafe-hashes', and 'report-sample' are interpreted as the spec requires. Scheme-only sources (https:, data:, blob:, filesystem:, mediastream:, ws:, wss:) match any target with that scheme, including the documented http to https and ws to wss upgrades. Host-source matching covers optional scheme, host with leading-* subdomain wildcards, optional port (numeric or *), and optional path prefix. Nonces and SHA-256, SHA-384, and SHA-512 hashes are matched against the inline body and the nonce attribute you provide; the SubtleCrypto digests are computed locally in the browser so the inline content is never transmitted. The result list shows per-resource verdict cards (allowed or blocked), the resolved directive name, the matched source expression, the reason in plain language, and notes that explain near-misses (wrong scheme, missing port, host wildcard not matching, 'self' not matching blob URLs, 'strict-dynamic' suppressing host-source matches on scripts, nonces being ignored on inline style attributes, and so on). A resolved-directives table breaks the request types out so you can see exactly which directive each resource type fell back to. Useful when you are tightening a CSP and want to confirm specific third-party hosts still load, when a vendor changed CDNs and you need to update one host source without breaking the rest, when an inline script needs a hash exception and you want the exact 'sha256-…' string to add, when 'strict-dynamic' is on and you want to see why a host allowlist is ignored, when iframe embedding is failing and you want to know whether frame-ancestors or X-Frame-Options is at fault, and when an audit report points at a specific URL and you want to reproduce the browser's decision locally. Everything runs in your browser; the policy, the page origin, the resource URLs, the inline bodies, and the computed hashes never leave your device.

Free to use. Works in your browser. No signup, no login.