Security headers
Split the header · Spot the parts that are effectively off · Build one
보안 헤더
CSP 를 갈래별로 펴서 약한 자리를 짚고, 필요한 것만 골라 헤더 한 줄을 지어 줍니다
헤더를 붙여넣으세요
Splits a Content-Security-Policy header into readable directives and points out the parts that effectively turn protection off. Pick a few options and it writes the header for you.
How to use it
- Paste the CSP header you are using
- Read the directives, one per line — what was unreadable as a single line is now a list
- Read the flagged parts (unsafe-inline, *, data: scripts) — each says why it matters
- Or pick only what you need and let it build a header for you
Common questions
- Why is there no grade or score?
- A letter grade gives reassurance without telling you what is actually risky. Instead, each finding says what it is and why it matters.
- Can I put it in a meta tag?
- Yes, but frame-ancestors and report-uri are ignored in meta — those need a real response header. On hosts that cannot set headers (GitHub Pages, for one), meta is the only place available.
- Is the header sent anywhere?
- No. Reading and building both happen entirely in your browser.
Other tools
Stays on your device What you enter is handled inside your browser only — nothing is stored or sent anywhere.
This tool page states where what you enter goes — see the badge above. All tools · KarmoLab · Who made this · Built with AI. View source