Web security tools
The headers that decide what a browser will let your page do.
A Content-Security-Policy that parses is not a policy that protects anything. unsafe-inline in script-src defeats the header's main purpose, a missing default-src leaves every undeclared directive open, and object-src or base-uri left unset are the two most commonly forgotten. These tools read the header you are actually sending and say which directives are doing work and which are decorative.
Free, with no sign-up. Every one runs entirely in your browser: nothing you paste is uploaded, and there is no server to send it to.
CSP Evaluator
Does this policy actually stop anything?
Paste a Content-Security-Policy header and find out what it really enforces.
CORS Preflight Explainer
Why the browser blocked it
Work out whether a browser will let your JavaScript read a cross-origin response, whether it preflights first, and which header is the reason if not.