Online Tool Store
CSP Header Builder
Create a Content-Security-Policy header from practical source controls, inspect the generated directive string, and copy it locally for deployment.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Choose the sources your site needs. This builder only drafts a header — test it in report-only mode before enforcing it.
Example policy shown — revise sources to match your site.
Generated HTTP header
Tip: avoid 'unsafe-inline' where possible and keep each external domain intentional.
How it works
- Set the baseline, script, and style sources that your pages need.
- Add defensive directives such as
object-src 'none'and HTTPS upgrades. - Copy the resulting header and validate it in report-only mode before enforcement.
The method
A CSP is a semicolon-separated list of directives. Each directive names a resource type and its allowed origins, so a tight policy starts with 'self' and only adds necessary exceptions.
FAQ
What is a Content-Security-Policy header?
It tells browsers which sources are allowed to load scripts, styles, images, and other page resources.
Should I enable a generated policy immediately?
No. Deploy it in report-only mode first, inspect violations, and add only the sources your site truly needs.
Does this scan my website?
No. This browser-only builder drafts a header from the source values you enter; it does not crawl or inspect a site.
How we compare
| Feature | Online Tool Store | Google CSP Evaluator | Report URI |
|---|---|---|---|
| Visual source controls | Yes | No | Yes |
| Policy evaluation | Drafting only | Yes | Yes |
| No account required | Yes | Yes | Varies |
Use this builder to draft and understand a focused CSP, then validate the exact production header with an evaluator or report-only deployment.