Disable Content-Security-Policy

Disable Content-Security-Policy for web application testing. When the icon is coloured, CSP headers are disabled.

Users70K

Rating3.6

Reviews99

Manifest versionV3

7-day growth0

7-day growth rate0%

Preview

Disable Content-Security-Policy Media preview

1 assets

Trend

30-day user trend

Review user movement over the last 30 days.

User Growth Over Time

Rating trend

30-day rating change

Track rating movement over time to see whether quality signals remain stable.

30-day rating change

Start

3.57

Latest

3.57

30-day rating change

0.00

2026年5月29日2026年6月4日

Growth overview

Daily, weekly, and monthly growth

Compare 1-day, 7-day, and 30-day net growth and growth rate.

1-day growthFlat

00%

7-day growthFlat

00%

30-day growthFlat

00%

Technical snapshot

Version, languages, and crawl freshness

Review publication date, version, supported languages, and crawl timestamps.

Version4.0.0

ManifestV3

Size29.02KiB

Languages2English / English (United Kingdom)

Published--

Store updated--

Last crawled--

Overview

Product summary

Review the store description, core capabilities, and common use cases.

Use at your own risk. Disables the current page's Content Security Policy. Useful when testing what resources a new third-party tag includes onto the page.

Reviews

Recent review snapshot

Inspect the latest comments and rating distribution.

The Chrome Web Store shows 99 reviews, but only 0 review bodies have synced into ExtScope so far. Showing the synced reviews available right now.

5★

4★

3★

2★

1★

Similar and related extensions

Review related products from the Chrome Web Store detail page.

CORS Unblock

Developer Tools

No more CORS error by appending 'Access-Control-Allow-Origin: *' header to local and remote web requests when enabled

Ignore X-Frame headers

Developer Tools

Drops X-Frame-Options and Content-Security-Policy HTTP response headers, allowing all pages to be iframed.

Anti-CORS, anti-CSP

Developer Tools

PaidConfidence 55

Enable cross origin requests blocked by CORS or CSP. Disable CORS and CSP in selected hostnames, preserve security of other websites

Content Security Policy (CSP) Generator

Developer Tools

Automatically generate content security policy headers online for any website.

Disable-CSP

Developer Tools

A browser extension to disable http header Content-Security-Policy and html meta Content-Security-Policy

Disable Content Security Policy

Developer Tools

A extension that set csp value empty

AI product read

Disables Content-Security-Policy (CSP) response headers on a per-tab basis via a toolbar icon toggle

Developers testing web applications need to bypass CSP restrictions to inspect what resources third-party tags inject, debug mixed-content issues, or test with external scripts that CSP would normally block

User navigates to a web page → clicks the extension icon in the toolbar → CSP response headers are stripped from all main_frame/sub_frame requests for that tab → icon changes color to indicate CSP is disabled → user reloads the page and can now load previously-blocked resources → clicking again re-enables CSP

Target users: Web developers / QA testers / Security researchers

Extension is very small (95 lines of JS), making full code review straightforward and deterministic
No remote endpoints or external service integration beyond GitHub homepage link

Monetization

No paid features detected

The extension is free and open-source under the Unlicense (unlicense.org). No payment, subscription, billing, or feature-gating code exists anywhere in the source. The 'pro' keyword hits were false positives: one from verified_contents.json (binary/base64 data containing substring 'pro' in a hash), and one from README.md where 'protect' is used in a security context, not a paid tier. The 'license' hit refers to the open-source Unlicense, not a commercial license.

Confidence: 100
Payment platform: --
Source: AI / High
Login required: No
Reason: No login, authentication, or account creation is needed. The extension operates entirely locally using Chrome's declarativeNetRequest API to strip CSP response headers. No remote services require user authentication. The 'auth' keyword hit was a false positive from the manifest 'author' field (line 8). The 'session' hits refer to Chrome's updateSessionRules API, not user sessions.

Permission risk

Medium-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

扩展能力较强：storage、activeTab

Publisher

Phil Grayson

Independent publisher

Email: [email protected]
Phone: --
Address: --

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access