Content-Security-Policy (CSP) Generator
Build a Content-Security-Policy header.
🔒 100% client-side — no data sent
Build a robust Content-Security-Policy (CSP) by picking your directives: script-src, style-src, img-src and more. Protect your site against XSS and content-injection attacks. Built entirely in the browser, with no data sent.
What is it for?
- ▸ Harden a site's security against XSS attacks
- ▸ Allow specific sources for scripts, styles and images
- ▸ Generate the CSP header or meta tag to paste in
- ▸ Test a policy before enforcing it
FAQ
What is a Content-Security-Policy?
An HTTP header that restricts the allowed sources of scripts, styles and media to block injected malicious code.
CSP via HTTP header or meta tag?
The HTTP header is recommended and more complete; the meta tag is a fallback without server access, with limits.
How do I test without breaking my site?
Use Content-Security-Policy-Report-Only: violations are reported without blocking content.