Raw CSP Policy
Input
âś•
or paste manually
âš
CSP Policy Quiz
Question of
Click an option to continue
Visual Policy Builder
âš
Report-Only
This policy came from Content-Security-Policy-Report-Only: browsers report violations but do not block anything.
This site sends policies, and browsers apply all enforced ones at once: a request must pass every one of them. Pick which one to edit:
Showing
of
directives
No values
âš
âš
Test a URL
Check whether the browser would load a URL under this policy.
'self' and relative URLs use the Target URL from Configuration.
Checked: → applied
Security Findings
Generated CSP Header
Visual Syntax Legend
Keywords
'self', 'none'
Nonces
'nonce-...'
Hashes
'sha256-...'
Schemes
https:, data:
Domains
*.google.com
Wildcard
* (Universal)