Paste the exact Content-Security-Policy header value, without the header name if possible.
Local CSP policy evaluator
CSP가 실제로 무엇을 허용하는지 확인하세요.
Inspect a pasted CSP header for duplicate directives, risky sources, and missing protection boundaries in this browser tab.
* Nothing is uploaded. CspLens parses the policy locally and never contacts listed origins.
Local CSP policy evaluator
Turn CSP text into reviewable decisions
CspLens checks duplicate directives, broad or unsafe sources, plain HTTP, and common missing boundaries.
Review each finding against your application before deploying. A stricter policy can also break required features if tested carelessly.
FAQ
What does CspLens check?
Does CspLens fetch my domains?
No. It only parses the policy text in this browser tab and never contacts its source URLs.
Why flag unsafe-inline and unsafe-eval?
They can weaken protections against script injection. Some applications still need compatibility exceptions, so the tool reports them for review instead of assigning a score.
Does a clean result prove a CSP is secure?
No. CSP behavior depends on the deployed response, browser support, application code, and the assets actually loaded.