CSP builder — generate a Content-Security-Policy
Choose what your site loads and get a ready-to-paste Content-Security-Policy header. It builds entirely in your browser (0 uploads, works offline).
How to use it
- Add any extra script, style or API hosts your site uses.
- Toggle inline styles/scripts and the upgrade-insecure option.
- Copy the CSP header into your server or meta tag.
FAQ
How do I create a Content-Security-Policy for free?
List the hosts your pages legitimately load from and toggle the options. This page assembles a sensible policy — self by default, object-src 'none', a locked base URI — and adds your hosts per directive, all on your device with no upload.
Should I allow inline scripts?
Avoid it if you can. Inline scripts are a common XSS vector, so 'unsafe-inline' for scripts is off by default; prefer moving scripts to files or using nonces.
Is my configuration uploaded anywhere?
No. The policy is built entirely in your browser and nothing is transmitted or stored, which you can verify by turning off your Wi-Fi.
Where do I put the generated header?
Send it as the Content-Security-Policy response header from your server, or add it as a meta tag; the response header is the more robust option.
Limits
Generates a solid starting policy; complex apps may need nonces, hashes or report-only tuning that you add by hand.
Related
The security-headers guidance pairs with this; the CSP violations you see should feed back into the host list.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.