CSP Generator & Evaluator
Analyzes Content-Security-Policy headers and suggests hardening rules.
Guide & best practices
CSP Evaluator for a secure Content-Security-Policy
Understand your CSP directives, spot XSS gaps from unsafe-inline and build a robust policy with nonces or hashes.
Typical use cases
Helps build and harden CSPs, run XSS reviews, migrate from X-Frame-Options to frame-ancestors and test via Report-Only.
How Balou evaluates CSPs
Balou breaks the CSP into directives, evaluates sources and unsafe keywords and gives concrete hardening guidance.
CSP best practices
Start with default-src self, avoid unsafe-inline/unsafe-eval, use nonces/hashes with strict-dynamic and test via Report-Only first.
Frequently asked questions
How do I build a secure CSP?
Start restrictive, e.g. default-src self; object-src none; base-uri self, then extend deliberately for required sources.
Why is unsafe-inline dangerous?
It allows inline scripts and undermines XSS protection; use nonce values or strict-dynamic instead.
What does frame-ancestors do?
It controls who may embed the page, protects against clickjacking and replaces the older X-Frame-Options.
How do I test a CSP safely?
Deploy it first as Content-Security-Policy-Report-Only with report-to, review violations, then enforce.