Content Security Policy (CSP) Header Generator
Protect your web application against cross-site scripting (XSS), clickjacking, and malicious data injections. Build a strict, production-ready Content-Security-Policy (CSP) header with a visual rule editor and instant copy-paste directives.
How to Use Content Security Policy (CSP) Generator
Select Source Directives
Configure default-src, script-src, style-src, img-src, and connect-src rules.
Add Trusted Domains
Whitelist trusted CDNs (Google Fonts, Cloudflare, Stripe, Google Analytics).
Copy Policy
Copy your CSP string as an HTTP Header or an HTML `<meta>` tag.
About Content Security Policy (CSP) Generator
Content Security Policy (CSP) is a foundational HTTP header that restricts the resources (scripts, images, stylesheets, iframes) that the browser is permitted to load and execute for a given page. A strict CSP neutralizes the vast majority of reflected and stored XSS attacks.
Supported Formats
Key Features
- Visual editor for all major CSP Level 3 directives
- Preset templates: Strict CSP, Modern SPA, Google Analytics / Tag Manager compatible, and Permissive
- Supports 'self', 'unsafe-inline', 'nonce-*', 'strict-dynamic', and domain whitelisting
- Generates HTTP response header and HTML `<meta http-equiv="Content-Security-Policy">` tags
- Report-Only mode toggle for safe testing in production
Frequently Asked Questions
Related Tools
More in Security & Utilities.htaccess Generator & Redirect Maker
Generate secure Apache .htaccess configuration files for 301 redirects, HTTPS enforcement, and security headers.
HTTP Headers Parser & Inspector
Parse raw HTTP request and response header text into structured tables with security insights.
Web Security Headers Checker & Audit
Audit your website's HTTP security headers for HSTS, Content Security Policy, X-Frame-Options, and vulnerabilities.