Content-Security-Policy Analyzer

No. The policy is parsed and audited entirely in your browser using plain string analysis. Nothing is uploaded, logged or stored, so it is safe to paste a header from a production site.

'unsafe-inline' tells the browser to allow inline <script> blocks and inline event handlers (and inline styles for style-src). That is exactly what most cross-site scripting (XSS) payloads rely on, so it largely defeats the protection CSP is meant to provide. Use a nonce or hash allowlist instead.

object-src controls legacy plugin content such as <object> and <embed>; setting it to 'none' removes an old but real attack surface. base-uri controls where a <base> tag may point, and without it an injected <base> can silently rewrite where every relative URL on the page resolves, redirecting script and form loads to an attacker.

A nonce is a random per-response token you put on both the header and each trusted <script>; a hash is the base64 SHA digest of a specific inline script's contents. Either one lets the browser run only the inline scripts you explicitly approve, which is the recommended replacement for 'unsafe-inline'.

No. The analyzer checks for common, well-known CSP weaknesses, but a real policy depends on your app's exact sources and behavior. Treat the findings as a strong starting point, then test the policy in report-only mode before enforcing it.