Content-Security-Policy (CSP) Generator
Build a Content-Security-Policy header.
🔒 100% client-side — no data sent
Build a robust Content-Security-Policy (CSP) by picking your directives: script-src, style-src, img-src and more. Protect your site against XSS and content-injection attacks. Built entirely in the browser, with no data sent.
What is it for?
- ▸ Harden a site's security against XSS attacks
- ▸ Allow specific sources for scripts, styles and images
- ▸ Generate the CSP header or meta tag to paste in
- ▸ Test a policy before enforcing it
FAQ
What is a Content-Security-Policy?
An HTTP header that restricts the allowed sources of scripts, styles and media to block injected malicious code.
CSP via HTTP header or meta tag?
The HTTP header is recommended and more complete; the meta tag is a fallback without server access, with limits.
How do I test without breaking my site?
Use Content-Security-Policy-Report-Only: violations are reported without blocking content.
Related tools
Basic Auth · header generator Generate the HTTP Authorization: Basic header from a username and password. Bearer · Authorization header Generate the HTTP Authorization: Bearer header and extract a token from a header. Code playground (JS/TS/Python/PHP) Run JavaScript, TypeScript, Python or PHP and see the result instantly, 100% in your browser. Color shades Generate the tints and shades of a color for your palette, in your browser. Cookie · parser Break down a Cookie or Set-Cookie header into readable key/value pairs. CORS headers · builder Generate CORS headers (Access-Control-Allow-*) for your server.