Content Security Policy (CSP) Builder

Build a CSP header directive-by-directive, with visible antipattern warnings.

default-src

Specific domains (space or comma separated)

script-src

Specific domains (space or comma separated)

style-src

Specific domains (space or comma separated)

img-src

Specific domains (space or comma separated)

connect-src

Specific domains (space or comma separated)

font-src

Specific domains (space or comma separated)

frame-src

Specific domains (space or comma separated)

object-src

Specific domains (space or comma separated)

object-src: object-src isn't set. A common hardening default is object-src 'none' — it blocks legacy plugin content (Flash/Java applets) that CSP can't otherwise restrict.

Content-Security-Policy header

default-src 'self'

Meta tag alternative

<meta http-equiv="Content-Security-Policy" content="default-src 'self'">

This builds a syntactically valid policy but is not a security audit — test the output against a tool like Google's CSP Evaluator before using it in production.

What is this tool?

A Content-Security-Policy restricts what a page can load and execute, directive by directive (script-src, style-src, img-src, and more). This builder assembles the final header (or meta-tag equivalent) from chip-selectable common source values plus your own domains, and visibly flags common antipatterns: 'unsafe-inline' or 'unsafe-eval' on script-src (both significantly weaken XSS protection), and a missing object-src (a common hardening default is 'none').

How to use it

For each directive, select common source values and/or type specific domains.
Review any antipattern warnings shown.
Copy the assembled header or meta tag.

What is this tool?

How to use it

Related network & web security tools