The Lab
Score a Content Security Policy
Most scanners will tell you whether a Content-Security-Policy header is
present, and then stop. That is not a useful answer. script-src * is
present. So is a policy built on a per-request nonce, and the two are not in the same
universe.
The CSP Index scores the header on a scale of 0 to 10, where higher is better. Paste a policy below and you get a number, plus the seven directive categories that produced the index.
Takes a bare policy or a whole block of response headers. Nothing leaves your browser.
Every one of these is a policy shape you may actually run into. Click one to load it.
How the number works
There are seven categories, one per attack surface, and I weighted each by how much
gets through when it is missing. Script execution got the most by a wide margin (0.40 out of 1.00),
and I capped the whole score at it so you can never score higher than your
script-src. If an attacker can run JavaScript in your users' sessions then
your form-action is decorative, and I did not want the score averaging that
away.
The other six degrade gracefully. A policy that covers five surfaces and misses one scores noticeably better than a policy that covers no surfaces except scripts.
The Dragon Scale
Five bands. The label is shorthand, and the seven categories below it are where the actual answer is.
- Ancient Wyrm
- 8.5 and up
- Drake
- 6.5 to 8.5
- Wyvern
- 4.0 to 6.5
- Drakeling
- 1.5 to 4.0
- Sheep
- under 1.5
What this does not do
This scores a header string. It is not scoring your site. A policy can earn a 9.0 sitting in front of an application riddled with stored XSS, because the number is telling you about the policy and not the code behind it. A high score does not guarantee your site is secure. It just means your CSP appears to be doing its job.
It also cannot tell you whether a domain in your allowlist happens to host something an attacker can reach (i.e. the "CSP bypass via trusted CDN" problem). On a test, that gap is usually how I get in. And it is not a remediation tool. It will point you at the directive that cost you the points, but it will not write the policy for you.
This is a proposal, not a standard
The scoring model is an open RFC. The weights, the rubric rows, the script cap: I picked all of it by judgment, informed by what I run into on tests and by running experiments across large CSP datasets, but I have not calibrated any of it against real outcomes yet. I wrote this calculator as the first working implementation of the model. I welcome your feedback, especially a policy this scores wrong.