CSP Header Generator
Build a Content-Security-Policy header interactively by filling in each directive.
Presets
Directives
Fill in at least one directive to generate the CSP header.
About CSP Header Generator
The Content-Security-Policy HTTP response header helps prevent cross-site scripting (XSS) and other injection attacks by specifying which sources the browser should allow for each resource type. Use 'self' to allow only your own origin, 'none' to block everything, or list specific URLs. Always test your CSP in report-only mode first using Content-Security-Policy-Report-Only.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Building a Content-Security-Policy directive by directive with the syntax handled.
- Producing a report-only policy to trial before enforcing it.
- Working out which directives a third-party embed needs.
- Assembling a policy directive by directive with each one's syntax handled for you.
- Comparing a header form against the meta-tag form.
Frequently Asked Questions
- Which directives actually matter most?
- `script-src` and `object-src`, because those are what stop injected code from executing. `default-src` is the fallback for anything you do not name, and `base-uri` is the quiet one — without it, an injected `<base>` tag can redirect every relative URL on the page to an attacker's host.
- What does 'unsafe-inline' cost me?
- Most of the protection. CSP's main defence against XSS is refusing to run inline scripts, so allowing them again means an injected `<script>` executes normally. If you need inline scripts, use a per-request nonce or a hash instead — those permit the ones you wrote and still block the ones you did not.
- What is 'strict-dynamic' for?
- It lets a script you have already trusted — via a nonce or hash — load further scripts, while ignoring host allowlists entirely. That is the point: host allowlists are routinely bypassed through a permitted CDN that also serves an old vulnerable library. Trust propagates from your nonce rather than from a domain.
- How do I roll out a policy without breaking the site?
- `Content-Security-Policy-Report-Only`. The browser enforces nothing and reports every violation to your `report-uri`/`report-to` endpoint, so you find out what the policy would have blocked before it blocks it. Every real CSP deployment goes through this step, usually for weeks.
- Header or meta tag?
- The header, wherever you can set one. A `<meta http-equiv>` CSP is applied late — anything before it in the document has already been parsed — and several directives, including `frame-ancestors`, `report-uri` and `sandbox`, are ignored entirely in meta form.
Common errors and gotchas
- Enforcing a policy without a report-only trial, which breaks the page for every visitor at once.
- Including `unsafe-inline` in script-src, which removes most of the protection.
- Omitting `default-src`, so unnamed directives fall back to allowing everything.
- Assuming the meta tag supports every directive, when several are header-only.
- Treating CSP as complete XSS protection, when it limits the damage rather than preventing injection.
Related Developer Utilities tools
RegExp Tester
Test regular expressions and inspect matches locally.
Regex Visualizer
Visual regex pattern diagram with live match highlighting and capture group annotations.
Subnet Calculator
Compute CIDR subnets, usable hosts, and network ranges.
Cron Parser
Translate cron syntax into plain English.
URL Parser
Break a URL into protocol, host, path, and query parts.
HTML Previewer
Paste HTML and see it rendered live in a safe, sandboxed preview.
HTTP Status Code Reference
Search and look up every HTTP status code and its meaning.
MIME Type Lookup
Find the MIME type for a file extension, or the extensions for a MIME type.