WHAT IT DOES
Read the policy as a browser will enforce it.
Paste a Content-Security-Policy header value to normalize its directives and review high-impact gaps such as unsafe script execution, universal script hosts, duplicate directives, unrestricted plugin content, and missing embedding, base URL, or form protections. The builder action loads a deliberately restrictive baseline as editable policy text; it is a starting point to adapt to the resources a real site needs, not a promise that an unmodified header will fit every application.
Why use it?
Use it to make an existing Content-Security-Policy easier to review and identify local-text warnings before testing the policy in your application.
How to use this tool
- Paste the header's policy value and inspect it, or load Safe baseline as a starting point.
- Review directive-specific warnings and edit allowed sources to match resources the application actually needs.
- For example, a missing frame-ancestors directive is not supplied by default-src. Review these independently rather than assuming one restrictive directive protects everything.
- Test the policy on a non-production deployment and inspect browser violations before enforcement. The baseline does not discover your resource requirements or certify the site's security.
Details and limitations
- Duplicate directive names are called out because browsers honor the first occurrence and ignore later attempts to replace it.
- script-src is read through its default-src fallback before unsafe-inline, unsafe-eval, and wildcard checks are evaluated.
- frame-ancestors, base-uri, and form-action are checked independently because none of them inherits a missing value from default-src.
- The copied result is a normalized Content-Security-Policy header assembled only from the directives that were entered or loaded locally.