CSP Header Generator
Build a Content-Security-Policy header directive by directive, with strict, moderate, and report-only presets and inline warnings when a choice weakens the policy.
Presets
Report-only sends the header as Content-Security-Policy-Report-Only, which reports violations without blocking anything.
Directives
default-src
script-src
style-src
img-src
font-src
connect-src
frame-src
frame-ancestors
form-action
base-uri
object-src
Everything runs in your browser. Nothing is uploaded.
- script-src allows 'unsafe-inline', so inline scripts run freely. This removes most of the protection against injected script.
- style-src allows 'unsafe-inline'. Lower risk than scripts, but injected styles can still be used to exfiltrate data.
Content-Security-Policy
nginx
Apache
How to generate a Content-Security-Policy header
Start from a preset
Pick strict, moderate, or report-only to load a working set of directives, then adjust from there.
Set each directive
For directives like script-src, style-src, and img-src, toggle self, none, unsafe-inline, unsafe-eval, data:, and https:, and add any extra hosts by hand.
Check the warnings
Read any inline warnings about choices that weaken the policy, such as allowing unsafe-inline on script-src.
Copy the header or server line
Copy the raw header value, or copy the ready-to-paste nginx or Apache configuration line.
Why use this tool
Eleven common directives
Covers default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, frame-ancestors, form-action, base-uri, and object-src.
Strict, moderate, and report-only presets
Load a tight starting policy, a more permissive one that tolerates inline styles and scripts, or a report-only version for testing without breaking anything.
Inline weakening warnings
A warning appears the moment a choice like unsafe-inline on script-src, or a missing object-src none, would weaken the policy.
Ready server config lines
Get the raw header value alongside a ready-to-paste nginx add_header line and an Apache Header set line.
Runs entirely in your browser
The header is built on your device; nothing about your policy or hosts is uploaded.
About this tool
A Content-Security-Policy header tells a browser which sources of scripts, styles, images, fonts, and other content a page is allowed to load, cutting down the damage an injected script or a compromised third party can do. Writing one directive by directive means remembering the exact keyword syntax, such as quoting 'self' and 'unsafe-inline', and it is easy to end up with a policy that looks strict but quietly allows more than intended.
This tool builds the header from toggles for each directive. Turn on self, none, unsafe-inline, unsafe-eval, data:, or https: for a directive like script-src or img-src, or add extra hosts by hand for a specific CDN or API. Choosing none for a directive clears every other option for it, since none by itself is the only source that makes sense. A warning appears immediately if a combination weakens the policy, such as allowing unsafe-inline on script-src or leaving object-src open to plugin content.
Strict, moderate, and report-only presets give a working starting point: strict locks almost everything to your own origin, moderate tolerates inline styles and scripts for sites that are not ready to remove them, and report-only sends the same policy as Content-Security-Policy-Report-Only so violations are logged without blocking anything. The output includes the raw header value plus a ready nginx add_header line and an Apache Header set line. Pair it with the .htaccess redirect generator or nginx redirect generator when hardening a server configuration.
Frequently asked questions
- What does a Content-Security-Policy header do?
- It tells the browser which sources are allowed to load scripts, styles, images, fonts, and other content on a page, which limits what an injected script or a compromised third party can do even if it gets into the page.
- What is the difference between the strict and moderate presets?
- Strict locks almost every directive to your own origin and blocks inline scripts and styles entirely. Moderate allows unsafe-inline for scripts and styles, which is more forgiving for a site that still relies on inline code but is a meaningfully weaker policy.
- What does report-only mode do?
- It sends the policy as Content-Security-Policy-Report-Only instead of Content-Security-Policy. The browser evaluates the policy and can report violations, but nothing is actually blocked, which is useful for testing a new policy before enforcing it.
- Why does the tool warn about 'unsafe-inline'?
- Allowing 'unsafe-inline' on script-src lets any inline script on the page run, which removes most of the protection a Content-Security-Policy is meant to provide against injected script. The warning appears as soon as the toggle is turned on so the trade-off is visible.
- Can I add my own hosts to a directive?
- Yes. Each directive has a free-text field for extra hosts, such as a CDN or an API domain, which are added to that directive alongside any toggles you have turned on.
- Is my policy uploaded anywhere?
- No. The header is built entirely in your browser and nothing about your configuration is sent to a server.
Related tools
Nginx Redirect Generator
Paste a list of old paths and new paths and get an nginx server block with matching return directives, or redirect an entire domain in one go.
.htaccess Redirect Generator
Turn a list of old and new URLs into Apache redirect rules. Set each row to exact or pattern matching, force HTTPS, canonicalize www, then copy a ready .htaccess block wrapped in <IfModule mod_rewrite.c>.
Markdown Table Generator
Build a Markdown table in a visual grid. Set rows and columns, type cell values, pick per-column alignment, and copy the generated Markdown.
MD5 Hash Generator
Compute the MD5 checksum of text or a file. Copy it as hex or Base64.
Meta Tag Generator
Build the search and social meta tags for any web page. Fill in the title, description, canonical URL, Open Graph, and Twitter fields, then copy a ready block of HTML with a live search snippet and social card preview.
Nano ID Generator
Generate short, URL-safe unique IDs with adjustable length, count, and alphabet.