Grade a site’s Content-Security-Policy and cross-origin exposure with actionable findings.
CSP / CORS Analyzer parses a target’s Content-Security-Policy and evaluates how effectively it mitigates XSS and data injection, while also examining cross-origin exposure. It highlights the weak directives that quietly defeat the policy.
A CSP can look present yet be trivially bypassable — this tool tells the difference and explains how to tighten it.
It allows inline scripts and event handlers to run, which is exactly what most XSS relies on — so a policy with unsafe-inline offers little real protection against script injection.