CSP Header Generator
Build a Content-Security-Policy with warnings and server-ready snippets.
About this tool
Start from a strict policy, a version that allows Google Analytics and Google Fonts, or a blank one. Tick the source keywords for each directive and add the hosts you load from. The generator writes the policy, warns about weak settings such as 'unsafe-inline' scripts or a missing object-src, and gives ready-to-paste snippets for an HTTP header, an HTML meta tag, nginx, Apache, Netlify and Vercel. Switch on report-only mode to test without blocking anything.
How a Content Security Policy protects a site
A Content Security Policy is an HTTP response header that tells the browser where a page may load resources from. If an attacker manages to inject a script tag through a cross-site scripting bug, the browser refuses to run it unless it comes from an allowed source. Each directive covers a resource type: script-src for JavaScript, style-src for CSS, img-src, font-src, connect-src for fetch and WebSocket connections, frame-src for iframes, and so on, with default-src as the fallback. A strong starting point is default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then adding only the hosts you actually use. The biggest weakness is 'unsafe-inline' in script-src, which lets any inline script run; move inline code into files, or use per-response nonces or hashes with 'strict-dynamic'. frame-ancestors controls who may embed your page and replaces the old X-Frame-Options header, but it, report-uri and sandbox don't work in a meta tag. Roll out a new policy as Content-Security-Policy-Report-Only first and check the browser console for violations before enforcing. Honest limits: this tool can't generate nonces or hashes, which your server must create for each response, and it doesn't scan your site to find the hosts you need. The security.txt generator publishes a security contact and the robots.txt generator controls crawlers. Hashing, encryption and encoding covers related security basics.
Frequently asked questions
What is a good default Content Security Policy?
default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; then add each external host you genuinely need.
Why is 'unsafe-inline' bad?
It allows any inline script to run, which is exactly what most cross-site scripting attacks rely on.
Can I set CSP in a meta tag?
Yes, for most directives, but frame-ancestors, report-uri and sandbox are ignored there. An HTTP header is better.
Is my data saved?
No. The policy is built in your browser and nothing is stored or sent.