CSP Builder
Build a Content-Security-Policy header from per-directive sources.
Directives
Leave a field blank to omit that directive.
Generated policy
As an HTML meta tag
Prefer sending CSP as the Content-Security-Policy HTTP response header over the meta tag — some directives (e.g. frame-ancestors) don't work in meta tags.
About the CSP Builder
Configure Content-Security-Policy directives like script-src, style-src, and img-src, and get a ready-to-use header value or HTML meta tag. Warnings flag risky choices like 'unsafe-inline' or wildcard sources.
Examples
Basic self-only policy
default-src 'self'Output
default-src 'self'; script-src 'self'Related tools
Security Headers Auditor
Security
Grade HTTP response headers against security best practices.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Htpasswd Generator
Security
Generate .htpasswd lines using SHA-1 or plain text.
JWT Inspector
Security
Decode a JWT and audit its claims for common issues.
Password Strength Checker
Security
Estimate password entropy, crack time, and get actionable advice.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
Frequently asked questions
Read more
- Content Security Policy from scratch
CSP is one of the most effective defenses against XSS, and one of the easiest to get wrong. Here's how to build a policy that actually works.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser