CSP Policy Inspector
Inspect CSP directives, resource fallbacks and report-only mode locally
The policy stays in this browser. Nothing is uploaded, saved or requested from the target site.
Accepts one header and comma-separated policies. A Content-Security-Policy-Report-Only prefix determines the mode.
Paste a policy, then choose Inspect locally.
This is a text inspection. It does not simulate complete browser matching, combined response headers or actual blocking.
How to read this
Each CSP policy applies separately. This shows directives and common fallback sources without combining policies into a security score. No limiting directive means only that this policy does not set one.
Input limit: 16 KiB. The first duplicate directive wins. This page never enforces CSP or sends violation reports.