Skip to content
ENExplore Calculators

CSP Effectiveness Calculator

Score a Content Security Policy directive by directive and see whether it would actually stop an injected script.

About CSP Effectiveness Calculator

script-src carries 30 of the 100 points because it is the only directive that decides whether an injected script executes, and unsafe-inline collapses it to 6 no matter how careful the host allow-list is. The remaining weight covers the directives that close the well-known bypasses: base-uri for injected <base> tags, object-src for plugin payloads and form-action for credential exfiltration. Most deployed policies are long, look strict and stop nothing, because one unsafe-inline or a missing base-uri hands the whole policy back to the attacker.

Formula

CSP Effectiveness

CSP score = script-src weight (30 nonce with strict-dynamic, 20 allow-list, 6 with unsafe-inline, 0 with unsafe-eval) + 12 enforced + 10 Trusted Types + 8 each for default-src, object-src, base-uri and frame-ancestors + 6 form-action + 6 reporting + 4 upgrade-insecure-requests = 100.

script-src
The directive that decides whether injected script runs
enforced
Report-Only policies score zero for enforcement

Worked example

With the default values below, CSP Effectiveness Calculator returns CSP Score of 66. Change any input above and every figure here is recalculated in your browser.

Inputs used

script-src strategyone of Nonce or hash with strict-dynamic — 30, Host allow-list, no unsafe-inline — 20, Allow-list with unsafe-inline — 6, unsafe-inline and unsafe-eval — 0
Host allow-list, no unsafe-inline — 20
Policy enforced, not Report-Only
Yes
require-trusted-types-for 'script'
No
default-src 'self' or 'none'
Yes
object-src 'none'
Yes
base-uri 'self' or 'none'
No
frame-ancestors set
Yes
form-action restricted to your own origins
No
report-to or report-uri configured
Yes
upgrade-insecure-requests
Yes

Results

CSP Score
66 / 100
CSP Grade
C — Fair
Meets the Strict-CSP Bar
No
Residual XSS Exposure
34%
Most Likely Bypass
An injected <base> tag re-points every relative script URL
Next Directive to Add
Add base-uri 'self'

Step by step

  1. 1Values used
  2. 2CSP Effectiveness
  3. 3CSP Score= 66 / 100
  4. 4CSP Grade= C — Fair
  5. 5Meets the Strict-CSP Bar= No
  6. 6Residual XSS Exposure= 34
  7. 7Most Likely Bypass= An injected <base> tag re-points every relative script URL
  8. 8Next Directive to Add= Add base-uri 'self'

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is CSP Effectiveness calculated?

CSP score = script-src weight (30 nonce with strict-dynamic, 20 allow-list, 6 with unsafe-inline, 0 with unsafe-eval) + 12 enforced + 10 Trusted Types + 8 each for default-src, object-src, base-uri and frame-ancestors + 6 form-action + 6 reporting + 4 upgrade-insecure-requests = 100. script-src carries 30 of the 100 points because it is the only directive that decides whether an injected script executes, and unsafe-inline collapses it to 6 no matter how careful the host allow-list is. The remaining weight covers the directives that close the well-known bypasses: base-uri for injected <base> tags, object-src for plugin payloads and form-action for credential exfiltration.

Why does CSP Effectiveness matter?

Most deployed policies are long, look strict and stop nothing, because one unsafe-inline or a missing base-uri hands the whole policy back to the attacker.

What values do I need to enter?

This calculator takes 10 inputs: script-src strategy, Policy enforced, not Report-Only, require-trusted-types-for 'script', default-src 'self' or 'none', object-src 'none', base-uri 'self' or 'none', frame-ancestors set, form-action restricted to your own origins, report-to or report-uri configured, upgrade-insecure-requests. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does a host allow-list score below a nonce?

Because allow-lists are only as strong as the weakest file on every listed host. A JSONP endpoint, an open redirect or a hosted copy of AngularJS on any allow-listed CDN turns the policy into a bypass. Nonces bind execution to a per-response value the attacker cannot predict.

Related Calculators

CSP Effectiveness Calculator | Calcrivo