CSP Header Generator

About CSP header generator

A Content-Security-Policy header tells the browser which sources of scripts, styles, images and frames a page may use, which limits the damage of an injected script. This editor starts from a strict policy, lets you switch directives on and off and add sources, and warns about choices that weaken the result.

How to use it

1. Review the Generated policy box, which begins with a strict preset.
2. In Directives, tick a directive to enable it or clear the tick to remove it.
3. Add sources with the one-click chips such as 'self', https: or data:, or type your own and press Enter. Several can be pasted separated by spaces or commas.
4. Read Policy review for high, medium and low warnings, then select Copy header or Copy value only.

The strict preset

Select Reset to strict preset

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

When to use it

• Drafting a first policy for a site and seeing exactly which risky sources it contains.
• Adding the analytics or CDN hosts a page really needs without opening script-src to everything.
• Preparing a Content-Security-Policy-Report-Only header to trial before enforcement.
• Explaining to a teammate why a wildcard or unsafe-inline source is flagged as high severity.

Questions about CSP header generator

Why does 'self' need quotes but https://cdn.example.com does not?

CSP keywords such as 'self', 'none' and 'unsafe-inline' must be single-quoted, or the browser treats them as host names. The tool adds the quotes for keywords, nonces and hashes, and leaves hosts and schemes alone.

Why does unsafe-inline count as high severity?

It allows inline scripts and handlers, which is exactly what an injected attack uses. Together with unsafe-eval, it removes much of what CSP is meant to provide. Nonces or hashes are the safer route.

Do frame-ancestors, base-uri and form-action inherit from default-src?

No. These do not fall back to default-src, so leaving them unset permits framing, base-tag injection and form posts anywhere. The review panel flags the missing ones.

What if a directive is enabled but has no sources?

It is omitted from the header entirely. Boolean directives such as upgrade-insecure-requests are the exception and appear as a bare name.

Should I deploy the header straight away?

No. Send it as Content-Security-Policy-Report-Only first, watch for reports, and enforce only once nothing legitimate is blocked. A too-tight policy can break scripts, fonts and forms.

Related tools

• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text
• Whirlpool GeneratorGenerate a Whirlpool hash from text
• Basic auth generatorEncode and decode HTTP Basic Authorization headers with ready-to-copy code snippets.
• JWT DecoderDecode and inspect JWT tokens — view header, payload claims, expiry, and signature.