vulnbeacon_TOOLS
← All tools

Web & TLS

CSP evaluator

Paste a policy for a local review, or explicitly fetch headers from an approved URL. Findings account for effective fallbacks and nonce or hash sources.

How to use CSP evaluatorSteps, privacy & next steps

Understand policy directives, effective fallbacks and hardening opportunities.

Run this check

  1. Paste one CSP header value for local review, or choose Fetch from URL for a permitted public response.
  2. URL mode requires a contact and current permission; switching modes clears the previous input.
  3. Review each enforcing and report-only policy separately, then validate changes in a browser on staging.

What you need

  • One CSP value, or an approved public URL in the separate network mode.

Your input & privacy

Pasted policies stay in your browser. URL mode sends a bounded request; exported observations omit raw policy sources and nonce values.

Read the result

Review specific directive behavior and proposed fixes. Keep report-only monitoring distinct from an enforcing policy.

Keep in mind

  • Static review does not execute scripts, measure nonce quality or prove browser enforcement.
  • Multiple enforcing policies combine restrictively. Separate policy warnings are not a combined vulnerability verdict.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.