Content-Security-Policy Generator

Build a Content-Security-Policy header from per-directive controls with self/none/unsafe-inline toggles, custom hosts, and inline warnings for weak choices like unsafe-inline and wildcards.

X LinkedIn Reddit

Content-Security-Policy Generator

Compose a CSP header per directive for hardening your own (authorized) apps.

default-srcFallback for fetch directives

script-srcJavaScript sources

style-srcStylesheet sources

img-srcImage sources

connect-srcXHR / fetch / WebSocket

font-srcFont sources

frame-srcEmbedded frame sources

frame-ancestorsWho may embed this page

Content-Security-Policy

default-src 'self'

Related Tools

CSP Evaluator

Analyze Content Security Policy for misconfigurations.

HTTP Header Analyzer

Analyze HTTP headers for security issues with A+ to F grading.

Security Header Scanner

Scan any URL for missing security headers with A+ to F grade.

CORS Misconfiguration Scanner

Test URLs for CORS misconfigurations with exploit code.

$loading...