CSP Header Builder

Build a readable Content-Security-Policy header from directive fields.

Input stays in this browser

Build a Content-Security-Policy header with a readable directive editor.

default-src

script-src

style-src

img-src

font-src

connect-src

frame-src

HTTP header value

default-src 'self';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https:;
font-src 'self' https:;
connect-src 'self';

Test a policy in report-only mode before enforcing it in production.

Usage

Add allowed sources to each directive, then copy the policy into your server configuration. Test in report-only mode first.

Policies are generated locally.