CSP Generator
Generate Content Security Policy headers visually
CSP Directives
Generated Output
Usage Examples
Basic Restrictive Policy
A simple policy that only allows resources from your own domain, with inline styles and data URIs for images.
CDN-Friendly Policy
A policy that allows loading scripts and styles from popular CDNs like jsDelivr, cdnjs, and Google Fonts.
Strict Security Policy
A highly restrictive policy that blocks everything by default and only allows specific resource types from your domain.
Features
Visual Builder
Build your CSP header visually with checkboxes and dropdowns, no manual syntax needed
Server Configs
Get ready-to-use configuration snippets for Nginx, Apache, and meta tags
CSP Validation
Test your CSP for common security issues and best practice violations
Privacy First
All processing happens locally in your browser, no data sent to servers
How to Use?
Select Directives
Enable the CSP directives you need and choose sources for each one using checkboxes or custom domains.
Review Output
View your generated CSP as an HTTP header, meta tag, or server config snippet. Test it for issues.
Copy & Deploy
Copy the generated CSP and add it to your web server configuration or HTML document.
Frequently Asked Questions
What Is Content Security Policy?
Content Security Policy (CSP) is an HTTP header that tells the browser which sources of content it should trust. Think of it as a whitelist: if a script, stylesheet, image, or font isn't from an approved source, the browser blocks it. This is your strongest defense against XSS attacks, because even if an attacker injects a malicious script tag into your page, the browser won't execute it if the source isn't whitelisted.
Why CSP Syntax Is Painful to Write by Hand
A real-world CSP header can easily be 500+ characters with dozens of directives, each with multiple sources. One misplaced semicolon breaks the whole thing, and there's no helpful error message - the browser just silently ignores the malformed parts. This tool gives you a visual interface: check boxes, dropdowns, and custom domain fields that generate valid CSP syntax automatically. You get output for HTTP headers, meta tags, Nginx, and Apache configs.
The Most Common CSP Mistakes
The biggest one is using unsafe-inline for scripts - it essentially turns off the XSS protection that CSP exists to provide. The second is using a wildcard (*) origin, which allows loading from any domain. The third is forgetting default-src, which means unspecified resource types have no restrictions. This tool has a built-in validator that flags all of these issues before you deploy.
Getting Started with CSP
Start with a report-only policy (Content-Security-Policy-Report-Only) to see what would break without actually blocking anything. Monitor the reports, fix the violations by adding legitimate sources, then switch to enforcement mode. This tool supports both modes and the presets give you common starting configurations for different security levels.
Privacy
Your CSP configuration never leaves your browser. No server calls, no storage, no tracking. The tool runs entirely in JavaScript.