CSP Header Builder
Assemble a valid Content-Security-Policy header from directive sources.
Build a Content-Security-Policy
A Content-Security-Policy is one of the strongest defences against cross-site scripting, but the header syntax is fiddly. This builder lets you set the sources for the common directives and assembles a valid policy string.
Enter ’self’ for default-src and add your CDN to script-src, and it produces a header like default-src ’self’; script-src ’self’ https://cdn.example.com. Leave a directive blank to omit it.
Correct and private
It joins your directives into a valid policy in your browser, so nothing you enter is uploaded. Test any new policy in report-only mode first.
Frequently Asked Questions
What is a CSP?
A Content-Security-Policy header tells the browser which sources of scripts, styles, images, and other content to trust, which mitigates cross-site scripting and injection.
How do I use the output?
Send it as a Content-Security-Policy response header, or place it in a meta tag. Start strict and loosen only where a page genuinely needs it.
What does self mean?
The special keyword ’self’ allows content from your own origin. ’none’ blocks everything, and specific domains allow just those hosts.
Browse the full set of free, private, in-browser tools.