Free Content Security Policy (CSP) Checker

Nginx

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' 'strict-dynamic'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;

Apache

Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-%{CSP_NONCE}e' 'strict-dynamic'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"

Node.js (Express + Helmet)

import crypto from "node:crypto"
import express from "express"
import helmet from "helmet"

const app = express()

app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(16).toString("base64")
  next()
})

app.use(
  helmet({
    contentSecurityPolicy: {
      useDefaults: false,
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: [
          "'self'",
          (_req, res) => `'nonce-${res.locals.cspNonce}'`,
          "'strict-dynamic'",
        ],
        objectSrc: ["'none'"],
        baseUri: ["'none'"],
        formAction: ["'self'"],
        frameAncestors: ["'none'"],
        upgradeInsecureRequests: [],
      },
    },
  }),
)

Next.js (middleware.ts, per-request nonce)

// middleware.ts - Next.js applies the nonce to its own
// inline scripts when the CSP arrives on the request headers.
import { NextResponse } from "next/server"

export function middleware(request) {
  // btoa works in both the Edge and Node middleware runtimes
  const nonce = btoa(crypto.randomUUID())
  const csp =
    "default-src 'self'; " +
    "script-src 'self' 'nonce-" + nonce + "' 'strict-dynamic'; " +
    "object-src 'none'; base-uri 'none'; form-action 'self'; " +
    "frame-ancestors 'none'; upgrade-insecure-requests"

  const requestHeaders = new Headers(request.headers)
  requestHeaders.set("content-security-policy", csp)

  const response = NextResponse.next({ request: { headers: requestHeaders } })
  response.headers.set("Content-Security-Policy", csp)
  return response
}

A static next.config.mjs headers entry cannot rotate nonces, and script-src 'self' on its own blocks the inline bootstrap scripts Next.js renders, so the CSP belongs in middleware. On Netlify and similar hosts, static header files have the same limitation.