Review homepage CSP and report-only status
Check key directives such as default-src, script-src, and object-src plus policy mode.
Open exampleCSP policy checker
Inspect a URL's Content-Security-Policy and Report-Only headers, then flag risky default-src, script-src, object-src, base-uri, and frame-ancestors settings.
Waiting
The result will appear here as structured cards.
Example results you can open
Short, high-intent examples that are easy to open, share, and understand for search engines and AI systems.
Audit script and embedding policy on a content page
Spot-check script-src, frame-ancestors, and mixed-content hardening signals.
Open exampleAudit resource-topic CSP rollout risk
Use the asset and third-party script topic to review script-src, connect-src, frame-ancestors, and report-only rollout risk.
Open exampleAudit website-check topic CSP exposure
Use the website-check topic to review script-src, frame-ancestors, report-only posture, and dual-origin policy consistency.
Open exampleReview llms.txt CSP and crawl-file headers
Confirm whether the AI crawl-file has CSP, content-type, cache, and security-header signals that support stable search and AI fetching.
Open exampleReview robots.txt CSP and crawl-rule headers
Check whether the crawl-rule file has clear CSP, content-type, cache, and security-header signals for search and AI fetchers.
Open exampleReview sitemap.xml CSP and submission-file headers
Check whether the sitemap submission file has clear CSP, XML content type, cache, and security-header signals for search systems.
Open exampleReview Baidu verification file CSP and headers
Check CSP, security headers, content type, and cache signals for the Baidu verification file so search systems can read it reliably.
Open exampleReview BingSiteAuth.xml CSP and headers
Check CSP, security headers, XML content type, and cache signals for the Bing verification file.
Open exampleReview IndexNow key file CSP and headers
Check CSP, security headers, content type, and cache signals for the IndexNow key file before relying on push diagnostics.
Open exampleCheck health JSON CSP exposure
Confirm the health endpoint's CSP, content type, cache, and security headers stay aligned with post-release crawl-entry QA.
Open exampleFAQ
These notes help users understand the results and help search engines and AI systems understand the tool.
What does CSP policy checker do?
It helps you inspect or process this value and get a readable result quickly.
Is my input saved?
Local tools run in the browser when possible. Server-side checks only use the input needed to complete the lookup.
How should I move from CSP report-only to enforced mode?
Start with `Content-Security-Policy-Report-Only` to collect breakage, then enforce incrementally. Prioritize script-src, object-src, frame-ancestors, and base-uri hardening first.
Why is unsafe-inline flagged as a major risk?
`unsafe-inline` broadens script execution paths and weakens XSS controls. Prefer nonce/hash-based script control with narrow source allowlists.
What should I check in CSP before launching third-party scripts?
List the real script, API, iframe, image, and reporting domains first, then review script-src, connect-src, img-src, frame-src, and frame-ancestors. Use Report-Only for new tags before enforcing the policy.
Related long-tail searches
Based on this query: https://chakan.com/baidu_verify_codeva-bbBatEi0N7.html
https://chakan.com/baidu_verify_codeva-bbBatEi0N7.html CSP policy checkerhttps://chakan.com/baidu_verify_codeva-bbBatEi0N7.html online checkerhttps://chakan.com/baidu_verify_codeva-bbBatEi0N7.html network troubleshootingCSP policy checkerContent-Security-Policy auditscript-src unsafe-inline diagnosticsframe-ancestors object-src checkCSP Report-Only rollout check