CSP Header Builder
Build Content-Security-Policy headers visually and audit common risky directives.
Generated Header
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' https:; frame-ancestors 'none'; base-uri 'none'; object-src 'none'
Policy warnings
- style-src includes 'unsafe-inline'. Consider nonce/hash based styles.
About This Tool
CSP Header Builder helps construct Content-Security-Policy values with safer defaults. It is useful when hardening web apps against script injection and resource loading abuse.
Frequently Asked Questions
Is this a full CSP validator?
No. It is a practical generator and risk hinting tool, not a full browser compatibility validator.
Should I allow 'unsafe-inline' in production?
Prefer nonce/hash strategies instead. 'unsafe-inline' weakens XSS protections significantly.
Is any policy data uploaded?
No. Header generation runs entirely in your browser.
Related Tools
Meta Tag Generator
Generate HTML meta tags for SEO. Title, description, viewport, robots, and canonical tags.
Cookie Audit Parser
Parse Cookie/Set-Cookie headers and audit Secure, HttpOnly, and SameSite flags.
Prompt Security Scanner
Scan prompts for secret leakage, PII, and injection-style phrases before sending to AI.
Workflow Links
Suggested step-by-step tools based on this page intent.
Before This Tool