Free Content Security Policy (CSP) Checker
Analyze your site's Content Security Policy for unsafe directives and coverage.
Detect unsafe-inline/unsafe-eval, weak sources, and get best-practice guidance.
- CSP directives analysis
- Detect unsafe-inline/eval
- Nonce/Hash guidance
"Barrion's security scanning has helped us implement best security practices efficiently, saving us countless hours."
Sarah Chen
Head of Security
"We identified and fixed critical vulnerabilities before our platform launch, saving us from potential data breaches."
Marcus Anderson
CTO
"Barrion gives us peace of mind, knowing we're notified of any security issues. Exactly what our team needed."
Oskar Nilsson
Tech Lead
Scan in three simple steps
Fast, safe, non-intrusive checks with actionable results.
Start scan
Enter your URL, and click the start scan button to begin.
Scan runs
Barrion performs passive, read-only security checks with minimal site impact.
View results
See security findings with prioritized, actionable recommendations.
What is Content Security Policy (CSP)?
CSP is a browser security layer that controls where your app can load resources from (scripts, styles, images, frames, etc.). A strict policy prevents XSS and reduces supply‑chain risk by blocking unexpected sources.
Why CSP matters
A strong CSP can neutralize whole classes of injection bugs and mitigate third‑party script risk. It also provides defense in depth when combined with escaping, sanitization, and Trusted Types.
What this checker validates
- Detects unsafe directives (unsafe-inline, unsafe-eval)
- Flags missing baselines: object-src 'none', base-uri 'none'
- Evaluates nonce/hash usage and recommends strict-dynamic
- Reviews frame-ancestors, form-action, upgrade-insecure-requests
How to fix common failures
- Replace script-src 'unsafe-inline' with nonces (rotate per request)
- Add object-src 'none'; base-uri 'none'; form-action 'self'
- Audit third‑party domains and restrict to explicit allow‑lists
- Enable upgrade-insecure-requests and avoid mixed content
Examples (good vs bad)
Bad: script-src 'self' 'unsafe-inline' https://cdn.example.com
Better: script-src 'self' 'nonce-...' 'strict-dynamic' https://cdn.example.com; object-src 'none'; base-uri 'none'
Tool-specific questions
Should I use nonces or hashes?
Do I need object-src and base-uri even if unused?
Can I allow *.cdn.com wildcards?
How often should CSP nonces rotate?
How do I migrate from unsafe-inline to nonces?
Why do third-party widgets get blocked?
Why Choose Barrion?
Real-Time Results
Instant security analysis with detailed reports, giving you an immediate security overview
Comprehensive Checks
Multiple best-practice security checks in a single scan, for broad coverage
Actionable and Effective
Clear recommendations for fixes, helping you improve your security quickly and effectively
Other Tools
Complete Security Scan
Complete website security analysis with comprehensive vulnerability detection
- Full security assessment
- Detailed security report
- Actionable recommendations
- Risk severity scoring
Security Headers Test
Check your website's HTTP security headers configuration
- Content Security Policy
- X-Frame-Options
- X-Content-Type-Options
- Permissions Policy
- Referrer Policy
- And more...
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
- HTTPS verification
- HSTS check
- TLS version check
- Cipher suite analysis
CORS Policy Checker
Validate Access-Control headers, credentials safety, and simulate preflight requests.
- ACAO configuration
- Preflight simulation
- Credentials safety
Cookie Security Checker
Audit HttpOnly, Secure, SameSite and Partitioned cookie attributes for safety.
- HttpOnly & Secure flags
- SameSite settings
- Partitioned cookies
Referrer Policy Checker
Validate Referrer-Policy and apply privacy-preserving safe defaults.
- Referrer-Policy detection
- Safe defaults
- Copyable examples
