CSP Analyzer — Analyze Content-Security-Policy Headers for Any URL

Analyze Content-Security-Policy headers for any URL. Extract CSP directives, identify weak patterns, detect missing protections, and rate policy strength — all in a single scan.

---

What does it do?

CSP Analyzer fetches one or more URLs and retrieves the Content-Security-Policy (CSP) header from the HTTP response. It then analyzes the policy, parsing every directive, evaluating it against known weakness patterns ('unsafe-inline', 'unsafe-eval', wildcard sources, data:, http:), and generating a strength score and rating.

The actor detects missing critical directives such as script-src, object-src, base-uri, and frame-ancestors. It also checks for the absence of a reporting endpoint (report-uri/report-to). Results are returned per-URL with structured policy breakdowns.

Batch mode allows scanning multiple URLs in a single run.

---

Who is it for?

This actor is designed for:

• Web application security engineers hardening CSP policies and reducing attack surface.
• Penetration testers evaluating client-side attack resistance as part of web application assessments.
• DevOps and platform teams implementing defence-in-depth for web properties.
• Bug bounty hunters identifying CSP weaknesses that may lead to XSS or data exfiltration.
• Compliance and security auditors verifying CSP implementation against standards (OWASP ASVS, PCI DSS).
• Frontend security champions ensuring that third-party integrations don't weaken the CSP.

---

Why use this?

Beyond header extraction. Other CSP checkers just show you the raw header. CSP Analyzer breaks every directive into its component parts, evaluates each source expression for risk, and gives you a security rating for the policy as a whole.

Weakness pattern detection. The actor flags dangerous CSP patterns: 'unsafe-inline' (inline scripts/styles), 'unsafe-eval' (code injection risk), wildcard (*) sources, data: URIs, and plain http: allowances. Each weakness comes with an explanation of the risk.

Missing protection identification. A CSP is only as good as its directives. The actor checks for critical directives that are commonly absent: script-src, object-src, base-uri, frame-ancestors, and report-uri/report-to. Each missing directive is flagged with an explanation of the risk.

Policy strength rating. Every policy receives a clear, repeatable rating from STRONG (80–100), MODERATE (50–79), WEAK (20–49), to CRITICAL (0–19). Use this rating to track CSP maturity over time or set gates in CI/CD pipelines.

Batch mode for portfolio-wide analysis. Scan multiple URLs in a single run and see which applications have strong CSPs and which are missing protection entirely.

---

Input Parameters

Parameter	Type	Required	Default	Description
urls	array	Yes*	—	Array of URLs to fetch and analyse (e.g., ["https://example.com", "https://app.example.com"]). Must include the protocol (https:// or http://).
url	string	Yes*	—	Single URL to analyse (alternative to urls). If both are provided, urls takes precedence.
timeoutSecs	number	No	15	Request timeout per URL in seconds (clamped to 5–60).
verifySSL	boolean	No	true	Whether to verify SSL certificates. Set to false for self-signed certs.

*Either urls (array) or url (string) must be provided.

---

Example Input

Single URL analysis:

{
  "urls": ["https://example.com"]
}

Batch CSP audit across multiple applications:

{
  "urls": [
    "https://example.com",
    "https://app.example.com",
    "https://admin.example.com",
    "https://dashboard.example.com"
  ]
}

---

📤 Output Format

The actor returns one result object per URL via Actor.push_data(). Each result contains the CSP analysis, policy breakdown, warnings, and a strength rating.

Field	Type	Description
url	string	The URL that was fetched
has_csp	boolean	Whether a CSP header was found (enforced or report-only)
strength_score	number	Overall policy strength (0–100)
strength_rating	string	Rating: STRONG, MODERATE, WEAK, CRITICAL, or NONE
status_code	number	HTTP response status code
final_url	string	Final URL after any redirects
elapsed_ms	number	Request duration in milliseconds
warnings	array	Security warnings and detected weaknesses
success	boolean	Whether the request and analysis completed
policies	object (optional)	Parsed CSP policies (absent when no CSP is found)
policies.enforced	object	Analysis of the Content-Security-Policy header
policies.enforced.directives	object	Parsed directive → source list mapping
policies.enforced.directive_count	number	Number of directives in this policy
policies.enforced.warnings	array	Warnings specific to the enforced policy
policies.enforced.policy_score	number	Score for this individual policy (0–100)
policies.report_only	object (optional)	Analysis of Content-Security-Policy-Report-Only (same sub-fields as enforced)
timestamp	number	Unix timestamp of when the result was produced
error	string (optional)	Error message if the request failed

---

Example Output

Successful scan with CSP found:

{
  "url": "https://example.com",
  "has_csp": true,
  "strength_score": 55,
  "strength_rating": "MODERATE",
  "status_code": 200,
  "final_url": "https://example.com",
  "elapsed_ms": 342.1,
  "warnings": [
    "style-src: 'unsafe-inline' — Allows inline scripts/styles — XSS risk",
    "Missing object-src — No object-src — plugins like Flash can execute",
    "Missing base-uri — No base-uri — script injection via <base> tag manipulation",
    "No reporting endpoint (report-uri/report-to) — violations undetected"
  ],
  "success": true,
  "policies": {
    "enforced": {
      "directives": {
        "default-src": ["'self'"],
        "script-src": ["'self'"],
        "style-src": ["'self'", "'unsafe-inline'"],
        "img-src": ["'self'", "data:"],
        "font-src": ["'self'"],
        "frame-ancestors": ["'none'"],
        "base-uri": ["'self'"],
        "form-action": ["'self'"]
      },
      "directive_count": 8,
      "warnings": [
        "style-src: 'unsafe-inline' — Allows inline scripts/styles — XSS risk"
      ],
      "policy_score": 55
    }
  },
  "timestamp": 1720000000.0
}

No CSP found:

{
  "url": "https://example-nocsp.com",
  "has_csp": false,
  "strength_score": 0,
  "strength_rating": "NONE",
  "status_code": 200,
  "final_url": "https://example-nocsp.com",
  "elapsed_ms": 215.3,
  "warnings": [
    "No Content-Security-Policy header found"
  ],
  "success": true,
  "timestamp": 1720000000.0
}

---

Use Cases

CSP hardening and migration

When migrating from no CSP to strict CSP, use the actor to baseline your current state, then iteratively tighten the policy. Run the analyser after each change to confirm improvement. Track your policy from CRITICAL/WEAK toward STRONG.

Pre-deployment security gate

Integrate CSP Analyzer into your CI/CD pipeline. Deployments that introduce a weakened CSP (or no CSP at all) can be flagged or blocked. Enforce a minimum MODERATE rating for staging deployments and STRONG for production.

Third-party integration risk assessment

Before adding a new third-party script (analytics, chat widget, A/B testing, ad network), evaluate what CSP changes it requires. The analyser will flag whether the integration forces you to introduce dangerous sources like 'unsafe-inline' or broad host-source wildcards.

Bug bounty CSP analysis

When approaching a new bug bounty target, run its URLs through CSP Analyzer to understand the attack surface. Weak policies that allow 'unsafe-inline', wildcard sources, or lack script-src entirely are prime candidates for XSS exploitation. Absent frame-ancestors means clickjacking vectors are in play.

Security compliance auditing

For compliance frameworks that require measured defence-in-depth (OWASP ASVS Level 2/3, PCI DSS v4.0 Requirement 6.4.3), use the actor to generate evidence that CSP is implemented and scored. The rating provides a clear, repeatable metric for compliance reports.

---

FAQ

Q: What happens if a URL doesn't have a CSP header?

The actor reports has_csp: false with a strength_rating of NONE and a strength_score of 0. It still returns status code, connection timing, and a warning that no CSP was found.

Q: Does the actor follow redirects?

Yes. The actor follows HTTP redirects to reach the final response. The CSP header from the final response is analysed, and both the original and final URLs are reported.

Q: Can the actor analyse CSP in meta tags?

The current implementation focuses on the Content-Security-Policy HTTP response header. CSP specified in <meta http-equiv="Content-Security-Policy"> tags is not analysed because meta-tag policies have limitations (e.g., they cannot use frame-ancestors, sandbox, or report-uri).

Q: What does the rating scale mean?

• STRONG (80–100): Policy has no dangerous sources and all critical directives are present.
• MODERATE (50–79): Policy present with some weaknesses or missing directives.
• WEAK (20–49): Policy exists but has significant dangerous sources or missing protections.
• CRITICAL (0–19): Policy is largely ineffective (wildcards, unsafe sources, missing key directives).
• NONE: No CSP header was found.

Q: Does this actor support CSP Level 3 directives?

Yes. The analyser understands both CSP Level 2 directives (default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, frame-ancestors, form-action, base-uri, report-uri, sandbox) and Level 3 additions (report-to, worker-src, manifest-src, prefetch-src, strict-dynamic).