Content Security Policy (CSP) Generator
Build a Content-Security-Policy directive by directive, export it as header, meta tag, Nginx or Apache config, and get warnings for unsafe settings.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests">
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
Import an existing policy
What is CSP Generator?
This CSP generator helps you write a Content-Security-Policy that restricts where scripts, styles, images, frames and other resources may load from. It starts from a strict policy, lets you edit each directive, and evaluates the result live, warning about weaknesses such as 'unsafe-inline', wildcard script sources, missing object-src or base-uri, and unquoted keywords. You can also import an existing policy.
How to use CSP Generator
- Start from the Strict starter policy or Clear all.
- Edit the sources of each directive, e.g.
'self' https://cdn.example.com. - Toggle upgrade-insecure-requests and add a report-uri if needed.
- Read the policy evaluation and fix high and medium findings.
- Copy the policy as an HTTP header, meta tag, Nginx or Apache line; or import an existing policy to analyse it.
Example
Strict starter policy
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
When to use CSP Generator
Use it to draft or review a CSP before deploying it. Roll out new policies with Content-Security-Policy-Report-Only first and watch for violations, because a strict policy will break inline scripts and third-party widgets you forgot to allow. The checks are static and cannot see which scripts your pages actually load.
How CSP Generator works
Directives are serialized in a fixed order as name source source; …, skipping empty ones. The evaluation applies static rules similar to Google's CSP Evaluator: keywords like self or none must be quoted; script-src (or default-src as fallback) without nonce/hash containing 'unsafe-inline', 'unsafe-eval', *, http:, https: or data: is flagged; object-src should be 'none'; base-uri, frame-ancestors and form-action should be set. The meta-tag version omits frame-ancestors, report-uri, report-to and sandbox, which browsers ignore in meta tags.
Common Use Cases
- Create a first strict CSP for a new site.
- Audit a policy copied from production for 'unsafe-inline' and wildcards.
- Add an analytics or CDN host to script-src correctly.
- Get the exact Nginx add_header line for a policy.
FAQs
Why is 'unsafe-inline' a problem?
It allows any inline script, including one injected through an XSS hole, which defeats the main purpose of CSP. Use nonces or hashes instead.
Header or meta tag?
Prefer the HTTP header. A meta tag cannot use frame-ancestors, report-uri or sandbox, and only applies to content after it.
How do I test without breaking my site?
Send the same policy as Content-Security-Policy-Report-Only; browsers report violations in the console without blocking anything.