CSP Header Builder & Analyzer
Build a Content-Security-Policy directive by directive, start from a strict nonce-based or analytics-friendly preset, and copy it as a raw header, an Nginx or Apache line, or a meta tag. Paste an existing policy to get a table of its directives and a list of weaknesses.
Private by design: anything you enter is processed in your browser only. It is never uploaded to or logged on our servers. Policies are built and analyzed locally; share links contain the policy and settings only.
Findings
Directives
| Directive | Sources | Meaning |
|---|
About Content Security Policy
Content Security Policy (CSP) is a response header that tells the browser which sources a page may load scripts, styles, images, frames and other resources from. Its main job is to limit the damage of cross-site scripting (XSS): even if an attacker manages to inject a <script> tag, the browser refuses to run it unless it matches the policy. CSP also controls who may frame your page (frame-ancestors), where forms may post (form-action) and whether the <base> tag can be changed (base-uri).
Allowlist policies such as script-src 'self' https://cdn.example.com are easy to write but often bypassable, because many CDNs host JSONP endpoints or old libraries an attacker can abuse. The approach recommended by browser security teams is a strict CSP: every script tag carries a random nonce generated for each response, and 'strict-dynamic' lets those trusted scripts load further scripts. A nonce must be unpredictable and different on every page load, so it has to be generated by your application or templating layer, not hard-coded in a static server config.
Deploy a new policy in Report-Only mode first. The browser then reports violations to report-uri / report-to without blocking anything, so you can see which inline scripts, analytics tags or third-party widgets would break. Once the reports are clean, switch to the enforcing Content-Security-Policy header. You can send both headers at the same time to trial a stricter policy while enforcing the current one.
A policy can also be delivered in an HTML <meta http-equiv> tag, but that form ignores frame-ancestors, report-uri, report-to and sandbox, and cannot be report-only, so a real header is better. Add the generated line to your server with the Nginx & Apache config generator, and compute 'sha256-…' hashes for small inline scripts with the hash generator (CSP hashes are the Base64-encoded SHA-256 of the exact script text).
Reference Guide
Directives and fallback
When a fetch directive is missing, the browser uses the next directive in its fallback chain. Directives marked "no fallback" are unrestricted unless you set them explicitly.
| Directive | Controls | Falls back to |
|---|---|---|
default-src | Default for all fetch directives | – |
script-src | JavaScript (elements, inline handlers, eval) | default-src |
style-src | Stylesheets and inline styles | default-src |
img-src | Images and favicons | default-src |
connect-src | fetch, XMLHttpRequest, WebSocket, EventSource, sendBeacon | default-src |
font-src | Web fonts loaded with @font-face | default-src |
object-src | <object> and <embed> | default-src |
media-src | <audio>, <video>, <track> | default-src |
manifest-src | Web app manifest | default-src |
frame-src | <iframe> contents loaded by your page | child-src → default-src |
worker-src | Web, shared and service workers | child-src → script-src → default-src |
frame-ancestors | Who may embed your page (replaces X-Frame-Options) | No fallback |
base-uri | Allowed URLs for <base href> | No fallback |
form-action | Form submission targets | No fallback |
sandbox | Applies iframe-style sandbox restrictions to the page | No fallback |
report-uri / report-to | Where violation reports are sent | No fallback |
upgrade-insecure-requests | Rewrites http:// subresource URLs to https:// | – |
Source expressions
| Source | Meaning |
|---|---|
'self' | Same origin (scheme, host and port) as the page |
'none' | Nothing is allowed; must be the only source in the list |
'unsafe-inline' | Inline <script>/<style> and event handlers. Ignored when a nonce or hash is present |
'unsafe-eval' | eval(), new Function() and string timers |
'strict-dynamic' | Scripts loaded by a nonced/hashed script are trusted; host allowlists and 'self' are ignored |
'nonce-<base64>' | Allows elements with a matching nonce attribute; must be random per response |
'sha256-<base64>' | Allows an inline script or style whose hash matches |
https:, data:, blob: | Any URL with that scheme. data: in script-src is unsafe |
https://cdn.example.com | A host; *.example.com matches subdomains but not example.com itself |
* | Any URL except data:, blob: and filesystem: |
Keywords must be written in single quotes. An unquoted self is treated as a host name called "self".
Example input
default-src 'self'; script-src 'self' 'nonce-{NONCE}' https://*.googletagmanager.com;
style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com;
img-src 'self' data: https://*.google-analytics.com https://*.googletagmanager.com;
connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com;
object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests
This sample loads automatically when you open the tool. Use Load Sample to bring it back.
Frequently Asked Questions
A CSP is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page may load. A strict policy blocks most cross-site scripting (XSS) attacks.
Start with Content-Security-Policy-Report-Only and a report endpoint, fix the violations it reports, then switch to the enforcing header once the reports are clean.
Allowing unsafe-inline in script-src lets any injected inline script run, which removes most of the XSS protection. Use nonces or hashes for the inline scripts you need instead.
Yes, but a meta tag ignores frame-ancestors, report-uri and sandbox. Send the policy as an HTTP header when you can.
Related Tools
All DevOps Tools →SPF, DKIM & DMARC Record Generator
Generate and check SPF, DKIM and DMARC DNS TXT records for e...
Dockerfile Linter
Lint a Dockerfile for security and best-practice issues: unp...
Docker Compose Validator
Validate docker-compose.yml files: YAML syntax, service keys...
HTML to PDF Converter
Render raw HTML into downloadable PDF files for sharing and...
Word to PDF Converter
Convert DOC, DOCX, and ODT files into clean PDF format.
PowerPoint to PDF Converter
Convert PPT and PPTX presentations to PDF for easier sharing...