Tools

Content Security Policy Builder

Build a Content-Security-Policy header tailored to your site. Configure script, style, font, and image sources. Includes nonce usage example and security warnings.

Site Features

Inline Scripts

Adds 'unsafe-inline' or nonce to script-src

Inline Styles

Adds 'unsafe-inline' or nonce to style-src

Use Nonce

Adds 'nonce-{NONCE}' and 'strict-dynamic' — recommended over unsafe-inline

Requires eval()

Adds 'unsafe-eval' — avoid if possible

✓

Allow Form Submissions

Sets form-action to 'self'

Allow Embedding (iframes)

Sets frame-ancestors to 'self'

Media from CDN

Adds media-src 'self' https:

✓

Upgrade Insecure Requests

Adds upgrade-insecure-requests directive

External Domains (comma-separated)

External Script Domains

External Style Domains

External Font Domains

External Image Domains

External Connect Domains (fetch/XHR/WS)

Report URI (CSP violation endpoint)

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

Generated Directives

default-src'self'

Fallback for all fetch directives. Restricts all content to the same origin by default.

script-src'self'

Controls where scripts can be loaded from. The most critical directive for XSS prevention.

style-src'self'

Controls where stylesheets can be loaded from.

img-src'self' data:

Controls where images can be loaded from. 'data:' is common for base64 embedded images.

object-src'none'

Blocks Flash, Java applets, and other plugin content. Always set to 'none' for modern apps.

base-uri'self'

Restricts the URLs that can be used in <base> elements. Prevents base tag injection.

form-action'self'

Restricts the URLs that forms can submit to. Separate from default-src.

frame-ancestors'none'

Controls which pages can embed this page in an iframe. Replaces the older X-Frame-Options header.

upgrade-insecure-requests

Instructs browsers to upgrade HTTP requests to HTTPS before fetching resources.