Security & Privacy 100% Local Processing Limit: Configuration input

Content Security Policy (CSP) Header Builder

Interactively build a Content-Security-Policy HTTP header with all directives, get an instant policy string, and understand each directive's security impact.

Sponsor Space

Content Security Policy Directives

Generated CSP Header

Sponsor Space

How to Use the Content Security Policy (CSP) Header Builder

  1. 1
    Select source allowlists for each directive (default-src, script-src, style-src, img-src, etc.).
  2. 2
    Enable or disable strict-dynamic, nonce, and unsafe-inline options.
  3. 3
    Copy the complete Content-Security-Policy header value.

Practical Example & Use Case

Common Real-World Scenario

Building a strict CSP that only allows scripts from your own domain and one CDN, blocking all inline scripts to prevent XSS.

Technical Notes & Limitations

Browser Engine Architecture

Generates CSP Level 2 and 3 compatible headers. Report-only mode and reporting endpoints are included in the output.

Frequently Asked Questions

What is Content Security Policy?

CSP is an HTTP response header that tells browsers exactly which sources are allowed for scripts, styles, images, and other resources. It is the most effective defense against XSS attacks.

What does unsafe-inline mean?

unsafe-inline allows inline