CSP Generator

What is a CSP Generator?

Build, configure, and validate HTTP Content-Security-Policy (CSP Level 3) security headers (`Content-Security-Policy: default-src 'self' ...`). Interactively configure directives for `script-src`, `style-src`, `img-src`, `connect-src`, `frame-ancestors`, and `report-uri`.

Why Use This Tool?

  • Mitigate Cross-Site Scripting (XSS): Block unauthorized inline scripts and malicious cross-site script execution.
  • Web Server Security Hardening: Configure CSP headers for Nginx, Apache, Caddy, Cloudflare, or Next.js apps.
  • Prevent Clickjacking & Data Exfiltration: Restrict frame embedding (`frame-ancestors`) and external API endpoint origins (`connect-src`).

How to Use

  1. Select allowed origins for each directive (`default-src`, `script-src`, `style-src`, `img-src`, `connect-src`).
  2. Toggle security flags (`'self'`, `'unsafe-inline'`, `https:`).
  3. Copy generated Nginx/Apache CSP header configuration string.

Real Working Example

Input:

default-src: 'self' | script-src: 'self' cdn.jsdelivr.net | style-src: 'self' fonts.googleapis.com

Output Result:

HTTP Header:
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.jsdelivr.net; style-src 'self' fonts.googleapis.com;

Important Technical Details & Security Standards

  • W3C CSP Level 3 Standard Compliance: Supports latest W3C directives including `object-src 'none'`, `base-uri 'self'`, and `upgrade-insecure-requests`.
  • Web Server Export Presets: Formats output syntax for Nginx (`add_header`), Apache (`Header set`), and Meta tags (<meta http-equiv="...">).
  • Local Memory Execution: Zero network overhead.

Related Security & Crypto Tools

Frequently Asked Questions

What is a Content-Security-Policy (CSP) header?

CSP is an HTTP response header that allows site operators to restrict the resources (JS, CSS, Images) that the browser is allowed to load for a given page.

How does CSP prevent Cross-Site Scripting (XSS) attacks?

By disallowing unauthorized external script domains and unsafe inline scripts, CSP prevents injected malicious scripts from executing.

What is the difference between CSP header and Meta tag?

HTTP headers are preferred because meta tags cannot enforce certain directives like `frame-ancestors` or `report-uri`.

Is it free?

Yes, 100% free.

What is Content-Security-Policy-Report-Only mode?

Report-Only mode tests CSP rules by sending violation reports to a URL without blocking resource loading on your website.

Is my CSP configuration sent to a server?

No, CSP builder operates 100% locally inside your web browser.

You May Also Need