noshost

Content Security Policy Workbench

Analyze a policy and connect weaknesses with supplied browser violation reports.

Paste the policy value without the header name.

Optional sanitized CSP reports. Remove private URLs and identifiers first.

Optional: compare this page with a synthetic meta-policy experiment. Response-only CSP directives cannot be reproduced this way.

One server job runs at a time. Private reports last up to 24 hours; the shared history retains at most 500 finished jobs. Download evidence you need to keep. Jobs have a three-minute execution budget; limits may stop a complex page earlier.

Verify a domain for origin checks, browser actions or webhook delivery

Publish the unique value in a DNS TXT record or a small file on your HTTPS website. Verification lasts 24 hours in this browser session.

Results

Submit a job to collect evidence. Its actual queue state will appear here.

Your recent jobs

No history loaded. Refresh to view jobs from this browser session.

What you can investigate

Analyze a policy and connect weaknesses with supplied browser violation reports. Review the affected endpoint or page, the measurement time and the suggested next action before changing your site.

Scope and privacy

Inputs and results are encrypted in our database and tied to this browser’s private ownership cookie. Only public destinations are allowed. Reports last up to 24 hours within the shared 500-report history; private recovery backups have a separate lifetime.

Browser experiments use Chromium from our server. They may observe a different response from another device, location or authenticated user. Automated accessibility findings need manual follow-up, consent observations are not legal certification, and rendered content does not prove search indexing.

Read the data-retention details

↑ ↓ moveEnter openEsc close

Expanded view