CSP Builder
Build a Content-Security-Policy header from per-directive sources.
Directives
Leave a field blank to omit that directive.
Generated policy
As an HTML meta tag
Prefer sending CSP as the Content-Security-Policy HTTP response header over the meta tag — some directives (e.g. frame-ancestors) don't work in meta tags.
About the CSP Builder
Configure Content-Security-Policy directives like script-src, style-src, and img-src, and get a ready-to-use header value or HTML meta tag. Warnings flag risky choices like 'unsafe-inline' or wildcard sources.
Examples
Basic self-only policy
default-src 'self'Output
default-src 'self'; script-src 'self'Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
Security Headers Auditor
Security
Grade HTTP response headers against security best practices.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Permissions-Policy Header Generator
Security
Build a Permissions-Policy header controlling camera, geolocation and more.
Referrer Policy Generator
Security
Pick a Referrer-Policy value and get header/meta/server snippets.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
X-Frame-Options / Clickjacking Checker
Security
Check if X-Frame-Options and CSP frame-ancestors block framing.
Frequently asked questions
Read more
- Content Security Policy from scratch
CSP is one of the most effective defenses against XSS, and one of the easiest to get wrong. Here's how to build a policy that actually works.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser