CSP Header Generator
Build Content Security Policy headers visually. Configure directives, pick sources, and copy your policy — entirely in your browser.
Fetch Directives
Document Directives
Navigation Directives
Reporting
Select a preset or configure directives above
Your CSP policy is built entirely in your browser. Nothing is stored or transmitted.
CSP Header Generator FAQ
What is Content Security Policy?
CSP is an HTTP header that tells browsers which sources of content (scripts, styles, images, etc.) are allowed to load on your page. It's one of the most effective defenses against cross-site scripting (XSS) attacks.
Should I use Report-Only mode?
Yes, start with Content-Security-Policy-Report-Only to test your policy without breaking anything. Once you confirm no legitimate resources are blocked, switch to enforcing mode.
Why is 'unsafe-inline' discouraged?
Inline scripts and styles are the primary vector for XSS attacks. If you must use inline code, prefer nonce-based or hash-based allowlisting over 'unsafe-inline'.
What does default-src control?
default-src is the fallback directive. If you don't set a specific directive (like script-src), the browser uses default-src instead. Setting default-src to 'none' and explicitly whitelisting each resource type is the most secure approach.
Secure your data in transit too
CSP protects your pages. CredenShare protects your secrets. Share API keys, passwords, and credentials with end-to-end encryption.