Security Tools · Server-side processing

CSP Header Analyzer

Fetch and analyze Content-Security-Policy headers from any URL. Detect weak directives, missing policies, and XSS risks.

🛡️

Enter a URL above to analyze its Content-Security-Policy headers.

🤖 AI Prompt

Ask an AI to help write a CSP policy:

Write a Content-Security-Policy for a modern web app that uses: React (inline scripts), Google Analytics, Cloudflare CDN, Stripe.js, custom fonts from Google Fonts, and WebSockets to wss://api.example.com. The policy should be strict enough to prevent XSS but permissive enough to not break any functionality. Explain each directive.