How to use it
- Type the directives in Policy, one per line, with their names exactly as written, such as script-src.
- Pick Delivery: Content-Security-Policy enforces the policy, and Content-Security-Policy-Report-Only is the header to test it with first.
- Read Rule that applies, by resource to see which directive covers scripts, styles, images and frames.
- Copy the Header line to your server, and fix each warning listed under the result.
Which rule applies to a resource
A browser checks each kind of resource against one directive. When that directive is missing, it falls back along a chain, and the table shows the chain it followed. The chains come from CSP Level 3, section 6.8.3.
- Scripts: script-src-elem, then script-src, then default-src.
- Inline event handlers: script-src-attr, then script-src, then default-src.
- Stylesheets: style-src-elem, then style-src, then default-src. Inline style attributes follow the same pattern with style-src-attr.
- Frames: frame-src, then child-src, then default-src.
- Workers: worker-src, then child-src, then script-src, then default-src.
- Images, fonts, media, objects, manifests and fetch requests: their own directive, then default-src.
What the checker reads
Directives are separated by semicolons, and this tool also takes line breaks. A name is read up to the first space and is not case-sensitive. When a directive appears twice, the first one counts and the repeat is skipped (CSP Level 3, section 2.2.1).
- Keywords such as 'self' and 'none' are written in single quotes. 'none' has to stand alone in its list.
- A nonce is 'nonce-' followed by a base64 value. A hash is sha256, sha384 or sha512, a dash and a base64 value (section 2.3.1).
- A comma is not allowed inside a directive value, because it separates policies in the header.
What the checker does not do
- It does not load the page or test the policy in a browser. The table shows the rule a browser would use, not whether your page still works.
- It checks the spelling of keywords, nonces and hashes, but it does not check host and scheme sources in detail.
- It does not judge directives it does not list, such as sandbox. They stay in the header line unchanged.
Worked example: the sample policy
With the sample policy, scripts use script-src, because script-src-elem is missing. Frames have no frame-src or child-src, so they fall back to default-src. Workers have no worker-src or child-src, so they use script-src. The style-src directive carries 'unsafe-inline', and the checker reports it as one warning.
| Resource | Checked in order | Rule in use |
|---|---|---|
| Scripts (script elements) | script-src-elem, script-src, default-src | script-src |
| Frames (iframe) | frame-src, child-src, default-src | default-src |
| Workers | worker-src, child-src, script-src, default-src | script-src |
Frequently asked questions
Why does the table show a rule I did not write for scripts?
A resource with no directive of its own uses the directive it falls back to. For scripts that is script-src-elem, then script-src, then default-src. The table shows the rule a browser would use, so a missing script-src can still give you a rule.
What does 'unsafe-inline' allow?
It allows inline script or inline style in the places the directive covers. A nonce or a hash in the same source list makes browsers ignore 'unsafe-inline' (CSP Level 3, section 6.7.3.2), so use one of those for the inline code you need.
Should I write report-uri or report-to?
Use report-to. MDN describes it as the directive that replaces report-uri. While report-to is not broadly supported, MDN advises to send both, and the checker warns when report-uri is present.
Why is one of my directive names marked as unknown?
The checker judges only the directives browsers ship and MDN documents. A name it does not know stays in the header line unchanged, but it is not in the table and is not judged.
Does the tool send my policy anywhere?
No. The header is built in your browser. Nothing you type is sent to us or stored, and the policy is not tested on any site.
Is CSP Level 3 a final standard?
Not yet. The text this checker follows is a W3C Working Draft dated 27 October 2026, a draft on the Recommendation track. Read the latest version before you rely on a rule in a production policy.
Sources
- CSP Level 3, W3C Working Draft of 27 October 2026 (sections 2.2, 2.3.1, 4.4.1, 6.7.3.2 and 6.8.3)
- MDN: Content-Security-Policy header, its directives and their fallback
Figures and text last checked on Tuesday, November 10, 2026.