Skip to content
danieljh

CSP Builder.

Build a Content-Security-Policy one directive at a time, with keywords quoted for you and risky combinations flagged. Outputs a header and a meta tag.

Input

How to fill in sources

Each directive takes a list of sources separated by spaces. No commas, no quotes around URLs.

  • Keywordsself, none, unsafe-inline, unsafe-eval
    Bare or quoted. The tool wraps them in single quotes for you.
  • Same origin'self'
    Scheme + host + port match the page.
  • URLshttps://cdn.example.com
    Include the scheme. Port matters.
  • Wildcards*.example.com https://*.cdn.example.com
    Subdomain wildcard. * alone allows any origin (avoid).
  • Schemesdata: blob: mediastream:
    Note the trailing colon.
  • Noncesnonce-AbCdEf
    Auto-quoted. Pair with a matching nonce attribute in your HTML.
  • Hashessha256-AbCd... sha384-... sha512-...
    Auto-quoted. Base64 of the script/style body.
  • Block all'none'
    Must be the only value in the directive.
  • default-srcFallback for fetch directives.

    Example: 'self'

  • script-srcJavaScript sources.

    Example: 'self' https://cdn.example.com 'nonce-abc123'

  • style-srcStylesheets and <style>.

    Example: 'self' https://fonts.googleapis.com

  • img-srcImages.

    Example: 'self' data: https://images.example.com

  • font-src@font-face sources.

    Example: 'self' https://fonts.gstatic.com

  • connect-srcfetch / XHR / WebSocket / EventSource.

    Example: 'self' https://api.example.com wss://api.example.com

  • frame-srcSources for <iframe> / <frame>.

    Example: 'self' https://www.youtube.com

  • frame-ancestorsWho can frame this page (replaces X-Frame-Options).

    Example: 'self'

Extras

Output

Configure directives on the left.

About this tool.

Fill in source lists per directive (default-src, script-src, …) and the tool emits a ready-to-use Content-Security-Policy header and a matching <meta http-equiv> tag. Bare keywords like 'self' / 'unsafe-inline' / 'unsafe-eval' are quoted for you, as are nonce-… and sha256-… sources. The linter flags wildcards, unsafe-inline / unsafe-eval, data: in script-src, plain-http origins, and CSP3 best-practice hints like missing default-src or object-src 'none'.

Privacy.

Runs in your browser

Everything happens in your browser. The composed CSP is never sent anywhere.

Disclaimer. Provided as-is, with no warranty of any kind. Always check critical results before acting on them. I accept no liability for inaccuracies, bugs, or any loss or damages arising from use of these tools.

Spotted a bug or want to suggest an improvement?Let me know

More tools.

All tools