CSP Generator

Build a Content-Security-Policy header online — pick directives and sources, get the policy string and meta tag variant instantly.

Check the directives and sources you need — the policy string updates live.

	Directive	Sources	Extra hosts (space-separated)
	`default-src`	'self' 'none'
	`script-src`	'self' 'unsafe-inline' 'unsafe-eval'
	`style-src`	'self' 'unsafe-inline'
	`img-src`	'self' data: https:
	`font-src`	'self' data:
	`connect-src`	'self'
	`frame-ancestors`	'none' 'self'

upgrade-insecure-requests

block-all-mixed-content

Content-Security-Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; upgrade-insecure-requests;

<meta> tag variant

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; upgrade-insecure-requests;">

About CSP Generator

Compose a Content-Security-Policy without memorizing directive syntax: toggle default-src, script-src, style-src, img-src, font-src, connect-src and frame-ancestors, add extra hosts, and copy the finished header or <meta> tag.

The policy updates live as you change options, so you can iterate against your browser console.