CSP Generator

Generate Content Security Policy headers

Preset

default-src

Fallback for other directives

script-src

Valid sources for JavaScript

style-src

Valid sources for stylesheets

img-src

Valid sources for images

font-src

Valid sources for fonts

connect-src

Valid sources for fetch, XHR, WebSocket

media-src

Valid sources for audio and video

object-src

Valid sources for plugins

frame-src

Valid sources for iframes

frame-ancestors

Valid parents that can embed this page

base-uri

Valid URLs for <base> element

form-action

Valid targets for form submissions

Security Issues

• Warning: 'unsafe-inline' in script-src weakens XSS protection

Output

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'

Meta Tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'">

Report-Only Header (for testing)

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'

How to use CSP Generator

1Enter the policy directives you plan to allow (default-src, script-src, img-src, etc.).
2Enter the domains or schemes you trust as sources.
3Read the generated Content-Security-Policy header to paste into your server config.

Building a Content Security Policy

CSP = directive1 value1 value2; directive2 value3; ...

A CSP whitelists where the browser may load scripts, styles, images and connections, blocking injection of unauthorized content even if an XSS bug exists.

Start in report-only mode to log violations before enforcing, otherwise a too-strict policy can break legitimate resources on your site.

Frequently asked questions

What does default-src do?

It sets the fallback for any directive you do not specify explicitly, so 'self' there covers most tags.

Should I use report-only first?

Yes, monitor reported violations for a while so you can tune the policy without breaking the site.

Does CSP stop all XSS?

It drastically reduces impact but is a defense-in-depth layer, not a replacement for input sanitization.

More Tools

URL Encoder

Encode and decode URLs and special characters

CSP Generator

Generate Content Security Policy headers

Redirect Checker

Check HTTP redirect chains and status codes

SPF Record Checker

Analyze SPF records for email authentication