CSP Generator
Build a Content Security Policy header visually. Select sources per directive, add custom domains, and copy the ready-to-use header or server config snippet.
Build a Content Security Policy header visually. Select sources per directive, add custom domains, and copy the ready-to-use header or server config snippet.
A Content Security Policy (CSP) is an HTTP response header that tells browsers which sources are allowed to load resources on your page — scripts, styles, images, fonts, iframes, and more. It's the primary defence against cross-site scripting (XSS) attacks and data injection.
Generate your policy using this tool, then add it as a response header in your web server config. For Nginx: add_header Content-Security-Policy "your-policy" always; For Apache: Header always set Content-Security-Policy "your-policy" — the tool provides ready-to-paste snippets for both.
'unsafe-inline' allows inline JavaScript (