Content Security Policy Generator
Build a starting Content Security Policy from common source directives.
Generate a Content Security Policy
CSP restricts which resources a browser may load and can reduce the impact of injection vulnerabilities.
Begin with report-only testing and adapt the policy to resources your site genuinely needs.
How to use the Content Security Policy Generator
- Select only the resource sources the website genuinely needs.
- Generate the Content-Security-Policy header and review every directive.
- Deploy in report-only mode first, inspect violations and tighten the policy before enforcement.
Practical example
A site serving its own scripts can begin with self rather than permitting every HTTPS origin.
What this tool cannot guarantee
An incorrect policy can break website features, and CSP complements rather than replaces secure application code.
Combine the policy with recommendations from the Security Headers Generator and publish a responsible contact using the Security.txt Generator
Read the Website Security Headers Guide for implementation guidance and common limitations.
Frequently asked questions
Is the Content Security Policy Generator free to use?
Yes. It is available without an account or paid subscription.
Is my input uploaded or stored?
The core operation runs in your browser. Avoid pasting secrets into any web page unless the individual tool explicitly explains how the data is handled.
Should I review the result before using it?
Yes. Check the output for your project and test it in the intended environment before production use.