Content Security Policy Builder
Create CSP directives, identify common weaknesses, and export configuration for popular web servers and frameworks.
Content Security Policy builder
Build a CSP header and review common security weaknesses before deployment.
Policy directives
No directives added
Add directives manually or load the recommended policy.
Add directive
Generated policy
Add at least one directive
The generated policy will appear here.
Directives
0
Source expressions
0
Security review
default-src
Add default-src as a fallback for resource types without a dedicated directive.
object-src
Add object-src 'none' unless plugin content is explicitly required.
base-uri
Add base-uri 'self' or 'none' to restrict manipulation of the document base URL.
frame-ancestors
Add frame-ancestors to reduce clickjacking exposure.
Browser security
Restrict the resources and origins a web page may trust
A carefully tested Content Security Policy can reduce the impact of injected content and unauthorized resource loading.
Begin with report-only mode
Deploy the policy through the Content-Security-Policy-Report-Only header, review browser violations, and refine the trusted sources before enforcement.
Prefer nonces or hashes
Applications that require inline scripts should use unpredictable request-specific nonces or approved script hashes instead of enabling unsafe-inline.
Guide
About Content Security Policy Builder
Content Security Policy limits which origins and resource types a browser may load for a page.
This builder helps assemble directives, review risky values, and export deployment-ready header examples.
CSP should be tested carefully because an overly strict policy can break application functionality while a permissive policy may provide little protection.
What a CSP can restrict
CSP directives control scripts, styles, images, frames, connections, fonts, form targets, and other browser behaviors.
- script-src
- style-src
- img-src
- connect-src
- frame-ancestors
- object-src
Start with report-only mode
Deploy Content-Security-Policy-Report-Only first, observe violations, and refine the policy before enforcement.
Nonces and hashes
For required inline scripts or styles, prefer unpredictable per-response nonces or approved hashes over unsafe-inline.
Common CSP weaknesses
Broad wildcards, unsafe-inline, unsafe-eval, untrusted script hosts, and missing fallback directives can weaken protection.
FAQ
Frequently asked questions
What does CSP protect against?
CSP can reduce the impact of some content-injection and unauthorized resource-loading attacks.
Should I use report-only mode first?
Yes. It helps identify breakage before enforcement.
What is a CSP nonce?
A nonce is an unpredictable per-response value that authorizes specific inline content.
Is unsafe-inline recommended?
No. It significantly weakens script or style restrictions.
Can CSP replace output encoding?
No. CSP is defense in depth and does not replace secure coding or input handling.
Does this tool deploy the policy?
No. It generates policy text that you must test and configure on your platform.
Continue exploring
Related tools
Useful tools for the next step in the same workflow.
HTTP Header Analyzer
Analyze pasted response headers for common browser security controls.
Website Security
Website Security Scanner
Inspect HTTPS, TLS, headers, cookies, and common security configuration issues.
Website Security
SRI Hash Generator
Generate and verify integrity hashes for scripts and stylesheets.
Cryptography
Regex Tester
Test regular expressions, capture groups, and replacements.
Encoding & Data
SSL/TLS Checker
Inspect a live server's TLS protocol, cipher, certificate chain, expiration, and trust status.
Website Security
X.509 Certificate Decoder
Decode certificate identity, validity, algorithms, key details, and fingerprints locally.
PKI & Certificates