CSP Generator
Build a Content-Security-Policy header from directives.
Processed locally in your browser. Nothing you enter is uploaded or stored.
Overview
Builds a Content-Security-Policy header value from individual directives — a key defense against XSS by restricting which sources scripts, styles and other resources can load from.
How to use it
- 1Fill in the directives you need (leave others blank to omit them).
- 2Copy the generated header value into your server config or a <meta> tag.
Tips
- Start restrictive (default-src 'self') and loosen only what you actually need — a CSP that allows everything provides no protection.