CSP Debugger documentation

01

What you can paste

Paste a Content-Security-Policy header, a report-only policy or a browser console violation. Scopeva recognizes common directives, source expressions and the effective directive reported by the browser.

Processing stays in the browser, so the policy text is not submitted to Scopeva.

• Complete CSP response headers
• Individual directives such as script-src
• Console messages that include a blocked URL and directive

02

Interpreting recommendations

Recommendations explain which source expression may be missing and which directive should be reviewed. They are starting points rather than copy-and-paste production policies.

Prefer narrow host, nonce or hash allowances. Avoid adding broad wildcards or unsafe-inline only to silence an error, because that can weaken the policy's protection.

03

Test before enforcing

Deploy policy changes in report-only mode first, inspect real violation reports and verify critical user journeys. Move to enforcement only after expected scripts, styles, frames and network requests have been covered deliberately.