CSP Validator

CSP Validator is a free browser tool from DMARCguard that grades Content Security Policy headers, pinpoints weaknesses, and outputs paste-ready fixes. Content Security Policy is one of those security headers that sounds simple until you actually try to write one. You set a rule, test it, break half the site, tweak it, break something else, and eventually ship something you hope is tight. This tool shortens that loop by parsing what you have against W3C Level 3 specs and OWASP hardening guidance, then telling you exactly what to change.

The workflow is straightforward. Paste a CSP header value into the evaluator, and it returns a security grade along with a severity-ranked list of issues. Each issue comes with a corrected directive you can copy straight into your config. If you don't have a policy yet, the built-in generator creates a strict baseline from scratch, favoring nonces and hashes over deprecated approaches like unsafe-inline. A formatting tool helps structure long policies so they stay readable as they grow.

Everything runs client-side. The page never transmits your header to a server, which matters when you're debugging production policies that might reveal details about your stack. You paste, you grade, you close the tab, and nothing leaves your machine. That privacy posture makes it practical for quick checks during development or audits where you can't share config snippets externally.

The audience is web developers implementing browser security, site owners tightening their defenses against XSS and clickjacking, and compliance teams documenting that a domain meets hardening standards. If you've ever stared at a Content Security Policy violation in the console and wondered which directive tripped it, this tool walks you back through the logic.

CSP Validator sits within DMARCguard's larger ecosystem of email authentication and compliance tools, including DMARC, SPF, DKIM, MTA-STS, and TLS-RPT checkers. The CSP tool is a natural extension: both email headers and browser headers rely on precise syntax, and both fail silently when misconfigured. Having them under one roof saves hopping between sites.

Access is free. There's no account, no rate limit, and no paywall. The underlying DMARCguard platform offers paid tiers for domain monitoring and team features, but the CSP Validator itself costs nothing. If you're building or auditing a Content Security Policy and want a second opinion before pushing to production, this gives you one in a few seconds.