Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo test a Content Security Policy (CSP), do two separate checks: inspect the actual HTTP response that browsers receive, then trial any proposed change with a Content-Security-Policy-Report-Only response header. Report-only mode records violations without blocking resources, so you can exercise real pages and user flows before enforcement. A policy pasted into an evaluator is useful for reviewing its text, but it does not prove that your server sends that policy.
What a CSP test must prove
CSP is delivered by an HTTP response header. The browser applies the policy returned by the server for that response, not a policy stored in a configuration file, ticket, or online form. A useful test therefore answers two different questions:
- What is deployed? Inspect the response headers for the exact document and routes you care about, then observe browser behavior.
- Is a proposed policy safe? Send the proposal as
Content-Security-Policy-Report-Only, collect violation reports, and exercise representative pages and workflows.
These checks complement one another. A policy evaluator reviews supplied policy text and can flag weaknesses, but it cannot establish that a target server returns that text or guarantee protection. Google describes its CSP Evaluator as a convenience tool for assessing whether a policy is a strong cross-site-scripting mitigation and disclaims guarantees or warranties.
Check the live Content-Security-Policy header
Use curl to inspect the document response
Run this against the canonical URL whose policy you want to verify:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
curl -sS -D - -o /dev/null https://example.com/Look for a line beginning Content-Security-Policy:. The -D - option prints response headers and -o /dev/null discards the HTML body. Redirects can matter, so inspect the final response and, when appropriate, follow them:
curl -sS -L -D - -o /dev/null https://example.com/To print only CSP-related headers:
curl -sS -D - -o /dev/null https://example.com/ | grep -iE '^(content-security-policy|content-security-policy-report-only|reporting-endpoints|location):'Repeat the check for authenticated routes, localized URLs, subdomains, and API or HTML responses that are generated by different servers. A single successful home-page request does not establish that every route has the same header.
Inspect the browser’s received response
- Open the page in your browser.
- Open Developer Tools and select Network.
- Reload the page with the network panel open.
- Select the main document request, usually the request whose type is document.
- In Headers, expand Response Headers and locate
Content-Security-Policyand, if present,Content-Security-Policy-Report-Only. - Use the Console panel while navigating important flows. Enforced violations are reported as blocked-resource messages; report-only violations are reported as would-be violations without blocking the resource.
Check the response that the browser actually received. A reverse proxy, CDN, redirect, framework middleware, or hosting platform can add, remove, or replace a header after your application has generated it.
Recognize the difference between missing, empty, and malformed policy
- Missing header: that response does not deliver CSP. Do not infer a policy from an evaluator or from another route.
- Multiple headers: browsers can apply multiple policies, and an additional policy generally makes the combined result more restrictive. Verify why each header is present instead of assuming one replaces another.
- Malformed directive or source: the browser may ignore an invalid portion. Use the browser console and a policy evaluator to identify syntax and security issues, then verify the corrected header over HTTP.
- Meta element: a
<meta http-equiv="Content-Security-Policy">element is not a delivery method for report-only testing. Report-only must be sent as a response header.
Test a proposed policy in report-only mode
Send the candidate as a response header
Configure your test environment or deployment stage to return the candidate policy in Content-Security-Policy-Report-Only. For example, a server response might include:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.example; img-src 'self' data:; report-to csp-endpointThe exact directives must match your application. Do not copy this example as a complete production policy; it only demonstrates the header shape. In report-only mode, resources that violate the candidate are still allowed to load. The browser generates violation reports when a reporting destination is configured.
Configure a reporting endpoint
MDN documents defining an endpoint in the Reporting-Endpoints response header and selecting it with the policy’s report-to directive:
Reporting-Endpoints: csp-endpoint="https://reports.example.com/csp"
Content-Security-Policy-Report-Only: default-src 'self'; report-to csp-endpointThe endpoint must be prepared to receive reports and should be monitored for volume, sensitive data, and abuse. MDN notes that report-to should be specified for reports to have an effect. Browser support is not uniform, so MDN describes the older report-uri directive as deprecated but says it may be declared alongside report-to for compatibility while support for report-to is still broadening. Recheck compatibility for the browsers and deployment date that matter to your audience.
Exercise real application behavior
- Load the home page and representative content pages.
- Sign in, sign out, and complete forms.
- Open menus, modals, editors, checkout or payment flows, and any route that loads code dynamically.
- Test major browsers and device classes used by your audience.
- Review console messages and collected reports, grouping them by blocked-or-would-be-blocked resource, directive, URL, and user flow.
- Classify each report as required application behavior, an unwanted third-party dependency, a browser extension, or noise before changing the policy.
Coverage matters: a report-only run that never opens an administrator screen or an infrequently used checkout path cannot reveal violations on those paths.
Understand simultaneous enforced and report-only policies
If the response contains both Content-Security-Policy and Content-Security-Policy-Report-Only, the enforced policy continues to block according to its rules while the report-only policy produces reports for its candidate rules. Report-only does not weaken an existing enforced policy and does not turn blocked resources back on.
Evaluate policy text without confusing it with deployment
Paste the candidate policy into Google CSP Evaluator to look for policy-strength concerns, such as source expressions that can undermine an intended mitigation. Treat the output as advisory. It examines the text supplied to it; it does not fetch your server’s response, exercise your application, or guarantee that the resulting policy protects against every cross-site-scripting path.
| Check | Evidence examined | Best use | Important limitation |
|---|---|---|---|
| Live response and browser behavior | The header the server returns and violations observed while pages run | Confirming deployed configuration and finding site-specific failures | One page load may not cover every route, state, or user flow. |
| CSP policy evaluator | The policy text you provide | Reviewing likely weaknesses and policy strength | Does not prove delivery and offers no protection guarantee. |
| Report-only deployment | Browser observations under a proposed policy | Finding breakage before enforcement | Requires a reporting destination and representative traffic. |
Move from report-only to enforcement
After reports have been investigated, update the response to Content-Security-Policy in a controlled deployment. Keep monitoring browser errors and application telemetry after rollout. If a new violation appears, first confirm which response supplied the policy, which route generated it, and whether the resource is intentional. Roll back or narrow the deployment when a legitimate flow is broken; do not broadly add permissive sources merely to silence reports.
Common CSP-testing failures and fixes
No CSP header appears
Cause: you inspected a redirect, a different response, or a route whose proxy configuration differs. Fix: use curl -L -D -, inspect the final document request in DevTools, and test each relevant host and route.
Rank #4
The evaluator reports a problem, but the site seems unaffected
Cause: the evaluator reviewed pasted text while the server returned another policy, or no policy at all. Fix: compare the exact live response header with the text you evaluated.
Report-only messages do not appear
Cause: no reporting destination is configured, the endpoint is unreachable, the browser does not support the selected reporting mechanism, or your test did not exercise a violating resource. Fix: verify Reporting-Endpoints, report-to, endpoint availability, browser compatibility, and test coverage. Consider declaring report-uri alongside report-to where compatibility requires it, following current MDN guidance.
A resource is blocked even though the new policy is report-only
Cause: an existing enforced Content-Security-Policy header is still active, or another policy is being delivered. Fix: inspect all response headers and identify which enforced policy contains the blocking directive.
Reports are dominated by extensions or third parties
Cause: browser extensions, injected tools, analytics, ads, and chat software can generate noise. Fix: reproduce in a clean browser profile, label known third-party sources, and decide explicitly which integrations your policy is intended to permit.
Or skip the browser setup
ScreenshotNeo can capture the rendered result while you test a page visually; it is not a replacement for reading HTTP response headers or collecting CSP reports. It is useful when a visual regression is part of your verification workflow. ScreenshotNeo is a website screenshot API and MCP server for developers. Before capture, it accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and each response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. Learn about ScreenshotNeo.
One GET request returns an image or PDF:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpSee the ScreenshotNeo API documentation for the available options. The service supports full-page captures with lazy images loaded, CSS-selector element captures, dark mode, device presets and custom viewports, retina scale, PDF paper and page controls, custom CSS and JavaScript, clicks before capture, hidden selectors, waits for selectors, delays or network idle, request and resource blocking, custom headers, cookies, user agents, authorization, timezone and geolocation, transparent backgrounds, resizing, configurable caching, signed image links, asynchronous jobs with signed webhooks, bulk capture of up to 100 URLs per call, a usage API, and an OpenAPI specification. Parameters used by other screenshot APIs also work for easier migration.
Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 shots per month with no card. Paid plans start at $5 for 3,000 shots; every feature is on every plan. Sign up free for ScreenshotNeo.
FAQ
Can a CSP be tested with only an HTML meta tag?
No. A report-only policy must be delivered as an HTTP response header. A meta element cannot provide report-only testing.
Recommended Free Tools
Does a report-only header protect the site?
No. It reports candidate violations without enforcing that candidate. Any separate enforced policy still applies.
Is a policy evaluator enough for a security review?
No. Pair text evaluation with live-header inspection, browser testing, and representative application traffic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
