Build a Content-Security-Policy header with per-directive guidance. Hardens against XSS by default.
[object Object] 'self'; [object Object] 'self'; [object Object] 'self' 'unsafe-inline'; [object Object] 'self' data:; [object Object] 'self'; [object Object] 'self'; [object Object] 'self'; [object Object] 'none'; [object Object] 'none'; [object Object] 'self'; [object Object] 'self'; [object Object] 'none'
The policy is generated locally from your selections. Nothing is uploaded.
A Content-Security-Policy is a whitelist the browser enforces: scripts, styles, images, and connections may only come from origins you allow. Its headline win is XSS mitigation — even if an attacker injects a <script> tag, the browser refuses to run it unless script-src permits its origin. Use 'none' for things you truly do not need (object-src, frame-ancestors), avoid unsafe-inline in script-src if at all possible, and ship the header with report-only mode first (Content-Security-Policy-Report-Only) to catch breakage before enforcing.
The policy is metadata about your page: the browser refuses any resource outside the allow-list.
Priya ships a static marketing site with self-hosted fonts and one Google Analytics tag, and wants a tight policy.
Generate a Content-Security-Policy header online free: 12 guided directives with safe defaults and live preview.
Input validation and output encoding reduce the chance of injection, but a Content-Security-Policy limits the blast radius when something slips through: a browser that refuses to run scripts from unapproved origins cannot execute an injected payload. CSP is the last line of defense, and it costs one header.
The generator exposes 12 directives - default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, frame-ancestors, base-uri, and form-action - each with a one-line explanation of what it gates. Safe defaults pre-load the form so the common case (self everywhere, nothing exotic) is one click, and every edit updates the policy live.
It is an HTTP header that tells browsers exactly which sources of scripts, styles, images, and connections your page may load. Anything not allow-listed is blocked, which is the single most effective defense against cross-site scripting (XSS) attacks.
The generator starts from a conservative baseline: default-src set to self, scripts and styles limited to self plus unsafe-inline only where frameworks genuinely need it, and object-src set to none. Each of the 12 directives ships with a plain-English explanation so you know what you are allowing before you allow it.
Deploy it first as Content-Security-Policy-Report-Only instead of the enforcing header. Browsers report violations to the console without blocking anything; once the reports are quiet, switch to the enforcing header.
Why did the elephant paint its toenails red?
No paywalls, no signups, no data sold. Built by a solo developer who believes useful tools should be accessible to everyone.
☕Support me on Ko-fi— keep tools free100% of proceeds go towards hosting & building more free tools.