Add a first CSP to a brochure site
Start from the strict preset, add only your CDNs and API to script-src and connect-src, then ship it in Report-Only first to see what would be blocked.
CSP Generator
Compose a Content Security Policy from presets (strict, analytics, permissive), fine-tune every directive, enable Report-Only or upgrade-insecure-requests, and copy the HTTP header or meta tag, with warnings for unsafe-inline, unsafe-eval and wildcards.
- Clipboard
Preset
Generates a monitoring header that does not block resources.
Directives
Separate sources with spaces or commas.
HTTP header
Meta tag
Raw policy
Was this tool useful?
How does this tool work?
The CSP generator helps you write the Content-Security-Policy header that tells the browser which sources of scripts, styles, images and connections your site allows. It is meant for developers, front-end integrators and sysadmins who want to limit the impact of an XSS flaw without memorising directive syntax.
A CSP (W3C Content Security Policy Level 3) is a list of semicolon-separated directives, each followed by its sources: `default-src 'self'; script-src 'self' https://www.googletagmanager.com; object-src 'none'; base-uri 'self'`. Keywords such as `'self'`, `'none'` and `'unsafe-inline'` must be single-quoted, while hosts and schemes (`https:`, `data:`) are not. Fetch directives (script-src, img-src, connect-src…) fall back to default-src when missing, but base-uri, form-action and frame-ancestors do not, which is why the tool flags their absence.
The tool assembles the values you enter, removes duplicates and empty fields, and produces three outputs: the raw policy, the `Content-Security-Policy` header (or `Content-Security-Policy-Report-Only` in monitoring mode) and a `<meta http-equiv>` tag. It then checks the policy and warns when default-src, object-src or base-uri is missing, or when `'unsafe-inline'`, `'unsafe-eval'` or the `*` wildcard weakens protection. The value-less upgrade-insecure-requests directive tells the browser to load resources referenced over HTTP through HTTPS instead.
How to use this tool
Pick a preset
Select Strict, With analytics, Permissive or Custom, and turn on Report-Only if you want a non-blocking monitoring header.
Adjust the directives
Fill in default-src, script-src, style-src, img-src, connect-src, frame-ancestors and the other fields, separating sources with spaces or commas, and enable upgrade-insecure-requests if needed.
Generate and copy
Click "Generate CSP", read the warnings, then copy or export the HTTP header, the meta tag or the raw policy.
Use cases
Allow Google Tag Manager and Analytics
The analytics preset adds googletagmanager.com and google-analytics.com to the right directives, to be completed with the tags you actually load.
Fix a security scan finding
A scanner reports "Content-Security-Policy missing" or "unsafe-inline allowed": rebuild the policy and make sure no warning remains before putting it back in production.
Examples
Minimal CSP policy
Input
Directives: default-src 'self'; object-src 'none'; base-uri 'self'; Report-Only mode: offResult
HTTP header: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self' — no warningsTips and best practices
- Always test the policy in Report-Only on every page (forms, checkout, admin) before enforcing it: violations show up in the browser console.
- The meta tag ignores frame-ancestors, report-uri and sandbox and cannot be Report-Only: use the HTTP header for those cases.
- Do not type `self` without quotes: the browser then reads it as a host name and the source matches nothing.
Sources and references
- W3C, Content Security Policy Level 3 (opens in a new tab)Page in English
- OWASP, OWASP Secure Headers Project (opens in a new tab)Page in English
Frequently asked questions
Does a CSP prevent XSS attacks?
It does not fix the vulnerability, but it greatly limits what an injected script can do by blocking inline scripts and unapproved domains. A CSP with 'unsafe-inline' in script-src loses most of that protection. OWASP describes it as defence in depth, on top of proper output encoding.
Should I use the HTTP header or the meta tag?
The HTTP header is preferred: it applies from the very start of the page load and supports every directive. The meta tag helps on static hosting without header access, but it ignores frame-ancestors, report-uri and sandbox, and only protects content that comes after it.
How do I allow an inline script without unsafe-inline?
Add a nonce to script-src (`'nonce-randomValue'`, regenerated for every response and repeated in the script tag's nonce attribute) or the script's hash (`'sha256-…'`, the Base64 SHA-256 of its exact content). You can type these values directly in the script-src field; compute the hash with an SRI or hash generator.
Does 'self' include subdomains?
No. 'self' only matches the same origin: same scheme, host and port. To allow cdn.example.com or every subdomain, add `https://cdn.example.com` or `https://*.example.com` explicitly.
How does Report-Only mode work?
The Content-Security-Policy-Report-Only header evaluates the same policy without blocking anything: the browser just reports violations in the console and, if you add a report-to or report-uri directive, sends them to your collection endpoint. It lets you tune the policy before switching to the enforcing header.
Does frame-ancestors replace X-Frame-Options?
Yes, frame-ancestors is the modern replacement for X-Frame-Options and takes precedence in browsers that support it: `frame-ancestors 'none'` is equivalent to DENY. Many sites keep both for older clients. It only works in the HTTP header, not in a meta tag.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Generate HSTS, nosniff, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and X-Frame-Options for Nginx or Apache.
Security & privacyUse this tool
Generate the SRI integrity attribute of a script or stylesheet from pasted content, a file or a CDN URL.
Security & privacyUse this tool
Analyze HTTP headers to review security, caching, CORS, and cookie behavior.
Security & privacyUse this tool
Read next
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 min
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 min
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 min
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 min