IconVault's CSP Evaluator grades any Content-Security-Policy header you paste in. It parses every directive and runs a battery of security checks, scoring the policy from 0 to 100. Each check shows a pass, warn or fail verdict with a plain-English explanation and how many points it costs, so you know exactly what to fix.

It flags the usual weaknesses: unsafe-inline and unsafe-eval, wildcard sources, missing object-src, absent base-uri and form-action protection, and more. The honest caveat: this is static analysis, not a live browser test, so it grades the policy text rather than how your site behaves. Free and runs fully in your browser; your policy never leaves the page.