Vérificateur CSP Gratuit

Analyse tes directives CSP et traque les risques qui se cachent dedans. Vos données ne quittent jamais ce navigateur.

CONTENT-SECURITY-POLICY1 lines

default-src'self'

script-src'self' https://cdn.example.com 'unsafe-inline'

img-src*

style-src'self'

upgrade-insecure-requests(flag)

risque'unsafe-inline' in script-src

Inline code is allowed, which enables XSS. Prefer nonces or hashes.

avertissementWildcard source in img-src

* allows any origin. Restrict to specific trusted hosts.

avertissementMissing object-src

Set object-src 'none' to block plugins like Flash.

avertissementMissing base-uri

Set base-uri 'none' to prevent base-tag hijacking.

avertissementMissing frame-ancestors

Set frame-ancestors 'none' or 'self' to prevent clickjacking.

correctupgrade-insecure-requests enabled

HTTP subresources are upgraded to HTTPS.

Prêt