CSP Generator
Build a Content-Security-Policy header, including frame-ancestors and a report-only rollout mode.
Processed locally in your browser. Nothing you enter is uploaded or stored.
- Assemble a valid policy from labelled fields instead of remembering directive syntax.
- Includes `frame-ancestors`, the modern replacement for X-Frame-Options, alongside the core resource-loading directives.
- A report-only toggle switches the generated header name between enforcing and `Content-Security-Policy-Report-Only`, with `report-uri`/`report-to` fields to actually capture violations during rollout.
- Omit a directive by leaving it blank — no guesswork about defaults.
- Runs in your browser; copy the header straight into your config.
Why this is private
- Processed locally in your browser. Nothing you enter is uploaded or stored.
- Open your browser's DevTools → Network tab while using this tool — you won't see a request carrying your input, because it never leaves your device.
- Nothing you enter is uploaded to a server or shared with us — the processing happens entirely on your device.
Overview
Builds a Content-Security-Policy header value from individual directives — a key defense against XSS by restricting which sources scripts, styles and other resources can load from — including frame-ancestors for clickjacking protection and a report-only mode with a reporting endpoint for a safe rollout.
How to use it
- 1Fill in the directives you need (leave others blank to omit them).
- 2For a safe rollout: turn on report-only mode and fill in a reporting endpoint (`report-uri` and/or `report-to`), deploy, and watch for violations before enforcing.
- 3Copy the generated header value into your server config or a <meta> tag.
Tips
- Start restrictive (default-src 'self') and loosen only what you actually need — a CSP that allows everything provides no protection.
Frequently asked questions
What people use it for
Add a first CSP to a siteStart from `default-src 'self'` and add only the sources your pages actually use.
Tighten an existing loose policyRebuild it directive by directive, dropping wildcards and `unsafe-inline`.
Prevent clickjackingSet `frame-ancestors 'none'` (or specific trusted origins) — the modern, CSP-native replacement for the X-Frame-Options header.
Generate a report-only policy with a reporting endpointTurn on report-only mode and fill in `report-uri`/`report-to` to actually collect violation data before enforcing, not just produce the header name.
Document the intended policyKeep a readable source of truth alongside your server config.
Related tools
All security toolsCSP AnalyzerParse a CSP header and flag common weaknesses, including missing frame-ancestors and object-src.Security Headers CheckerCheck a live site's security-related HTTP headers, with a letter grade.Password Strength CheckerCheck a password's strength and estimated crack time.HMAC GeneratorGenerate an HMAC signature for a message with a secret key.
Ready to use CSP Generator?
CSP Generator