Skip to content
OpenElseSearch open-source alternatives…
CSP Evaluator product preview

CSP Evaluator

Google’s open-source tool for checking Content Security Policy strength and bypasses.

Type
Web Securitycspevaluatorxss
Hosting
Self-host optional
License
Apache-2.0
Replaces
Csper
Visit websiteGitHub

Quick verdict

Use when

Use when you need to validate a CSP before enforce mode, without Csper’s full monitoring SaaS.

Skip when

Skip when you need turnkey multiplayer cloud without running any local or hybrid stack.

Try instead

  • HTTP Observatory — Mozilla’s scanner for HTTP security headers, including Content-Security-Policy.
  • reportd — Self-hosted collector for CSP reports, Reporting API payloads, and Web Vitals.
  • CSP Kit — TypeScript CSP generator with presets for 100+ common web services.

CSP Evaluator vs common alternatives

Stable selection factors from this listing—focus, hosting, license, and access. Confirm live details on each official site.

CSP EvaluatorThis page

Focus
Google’s open-source tool for checking Content Security Policy strength and bypasses.
Hosting
Self-host optional
License
Apache-2.0

Csper

Focus
Content Security Policy tooling for generating, evaluating, and monitoring CSP reports.
Hosting
Commercial SaaS
License
Proprietary (typical SaaS)
DimensionCSP EvaluatorCsper
FocusGoogle’s open-source tool for checking Content Security Policy strength and bypasses.Content Security Policy tooling for generating, evaluating, and monitoring CSP reports.
HostingSelf-host optionalCommercial SaaS
LicenseApache-2.0Proprietary (typical SaaS)
AccessWebsite + GitHubcsper.io

What is CSP Evaluator?

CSP Evaluator is an open-source Web Security project. Google’s open-source tool for checking Content Security Policy strength and bypasses. OpenElse lists it as an alternative to Csper, with self-host optional deployment and Apache-2.0 licensing. Confirm live features, hosting options, and terms on the official site and repository.

What CSP Evaluator provides

Core signals from this OpenElse listing—verify depth on the official site.

  • Open-source codebase

    Source is published on GitHub at github.com/google/csp-evaluator.

  • Self-host optional

    Self-hosting or local use is available in some setups; check the project docs for what is supported.

  • Apache-2.0 license

    Distributed under Apache-2.0. Read the license text before production use.

  • Workflow tags

    OpenElse tags this listing for csp, evaluator, xss.

  • SaaS replacement mapping

    Mapped as an open-source option when evaluating replacements for that commercial product.

How to evaluate CSP Evaluator

A practical path from this directory page to a decision.

  1. Scan this listing

    Review the one-liner, self-host status, license, and “when to pick it” note for CSP Evaluator.

  2. Open the official site

    Visit csp-evaluator.withgoogle.com for product docs, demos, and current feature scope.

  3. Check the repository

    Use GitHub for release cadence, issues, stars, and deployment docs before you commit.

  4. Compare siblings

    Open other OpenElse tools in the same category or mapped to the same SaaS to see trade-offs.

Who CSP Evaluator is for

  • Teams leaving Csper

    Use when you need to validate a CSP before enforce mode, without Csper’s full monitoring SaaS.

  • Operators who want data control

    CSP Evaluator is listed as self-host optional on OpenElse.

  • Web Security buyers

    Open-source CSP builders, evaluators, and report collectors instead of Csper-style monitoring SaaS.

When CSP Evaluator is the right pick

Use when you need to validate a CSP before enforce mode, without Csper’s full monitoring SaaS. Skip when you need turnkey multiplayer cloud without running any local or hybrid stack.

Licensing and platform notes

Facts to verify on the official site before you depend on a workflow.

Self-host status
Self-host optional on this listing. Verify install paths and supported environments in the project docs.
License
Apache-2.0. Confirm obligations for SaaS, embedding, and redistribution before shipping.
Source of truth
Features and terms are defined on csp-evaluator.withgoogle.com and the GitHub repository—not on this page.
Affiliation
This route is a curated OpenElse listing at /tools/csp-evaluator. It is not the official CSP Evaluator product site.

Frequently asked questions

Quick answers about this listing—open a question to read more.

Is CSP Evaluator open source?

Yes. OpenElse lists CSP Evaluator as an open-source project under Apache-2.0. Review the license file in the repository for exact terms.

Can I self-host CSP Evaluator?

Partially. OpenElse marks CSP Evaluator as self-host optional. Some workflows may still rely on hosted or local-only modes—confirm in the official docs.

What does CSP Evaluator replace?

CSP Evaluator is mapped on OpenElse as an open-source alternative to Csper. Use when you need to validate a CSP before enforce mode, without Csper’s full monitoring SaaS.

Is this the official CSP Evaluator website?

No. This is a OpenElse directory page. The official site is https://csp-evaluator.withgoogle.com, and the source repository is https://github.com/google/csp-evaluator.

Where can I find CSP Evaluator source code?

The public repository linked from this listing is https://github.com/google/csp-evaluator.