Where do I get a page's CSP header value?

Open your browser's network inspector, select the document request, and copy the Content-Security-Policy response header, or use the Headers Checker tool.

Home/Developer/CSP Header Parser

DeveloperReady to use

CSP Header Parser

Break a Content-Security-Policy header into its individual directives and sources for review.

Documentation

Interactive workspace

No account required

CSP Header Parser

default-src

'self'

script-src

'self'https://cdn.example.com

img-src

object-src

'none'

What is CSP Header Parser?

Break a Content-Security-Policy header into its individual directives and sources for review.

How it works

SiteIndex splits a pasted Content-Security-Policy value on semicolons, then lists each directive with its allowed sources in an easy-to-scan table.

Where a network request is required, SiteIndex validates public HTTP/HTTPS targets before making the request.

Common uses

Review a CSP header before deploying a security policy change.
Spot an overly permissive or missing directive at a glance.
Document the current CSP rules for a page or application.

Limitations

Results depend on the browser, network, input, and external service involved.
This tool is informational and does not replace specialist diagnostics or professional advice.

FAQ

Where do I get a page's CSP header value?: Open your browser's network inspector, select the document request, and copy the Content-Security-Policy response header, or use the Headers Checker tool.

Related tools