Content Security Policy Builder

Compose and review a CSP locally. Start with a restrictive preset, add only the sources your application needs, then test in report-only mode before enforcing it.

Directives

Separate source expressions with spaces. Keywords require quotes, for example 'self', 'none', 'nonce-…', or 'sha256-…'.

Add another directive

Generated policy

Use the Content-Security-Policy-Report-Only header while testing

HTTP response header

HTML meta element (limited support)

Content Security Policy Builder

Import a header value

Directives

Generated policy

Review findings