How can I view the Content-Security-Policy header in Chrome?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Open DevTools, go to the Network tab, and reload the page.
• Select the main HTML request and view the Headers panel.
• The CSP header appears under Response Headers as Content-Security-Policy or Content-Security-Policy-Report-Only.

How do I open Chrome DevTools to inspect network traffic?

Press F12 or right - click any page element and choose Inspect; this immediately opens Chrome DevTools. The tool runs in the browser window and gives you access to console, elements, network, and other panels.

Which tab shows the HTTP response headers for a page?

Select the Network tab inside DevTools. This tab records every request the browser makes, and each row can be expanded to reveal detailed information.

How do I capture the request for the page I am viewing?

After opening the Network tab, reload the page (press Ctrl+R or click the reload button). Reloading forces the browser to log the initial document request as the first entry in the list.

Where can I find the CSP header among the recorded requests?

Click the first entry in the Network list - it represents the main HTML document. In the right - hand pane, choose the Headers sub - tab. Scroll down to the Response Headers section; the CSP header will be listed as Content-Security-Policy or Content-Security-Policy-Report-Only.

What does the CSP header value look like and how can I read it?

The header value is a string of directives, for example:

Content-Security-Policy: default-src 'self'; script-src 'self' https://apis.example.com; object-src 'none';

Each directive controls a specific resource type. You can copy the full value from the DevTools pane for further analysis or testing.

How can I verify that the header is actually being sent by the server?

If the Response Headers section does not contain any CSP line, the server is not sending a CSP header. You can also check the Status column to ensure the request succeeded (200 OK) and that you are looking at the correct request.

What if I need to see CSP headers for sub - resources like scripts or images?

Select any other request in the Network list (e.g., a JavaScript file) and repeat the same steps: open the Headers panel and look for Content-Security-Policy under Response Headers. Some servers may send CSP only on the main document, others may include it on every response.

How do I capture CSP headers for pages that use Service Workers?

Service Worker responses are also listed in the Network tab. Look for entries with the Service Worker type, open their Headers panel, and locate the CSP header just like any other request.

How can I export the CSP header for documentation or compliance?

Right - click the request line in the Network tab, choose Copy > Copy response headers, then paste the text into a document. This provides a reproducible record that can be linked to compliance mapping tools.

Related resources

• Decloak’s free scan quickly checks for missing security headers, including CSP, across the eight core layers. Learn more in the free scan overview.
• For a deeper audit of CSP directives against best - practice checklists, see Decloak’s compliance mapping guide: Compliance Mapping Explained.