Content Security Policy Builder

1 directive enabled
Fetch Directives
'self'
Document Directives
Navigation Directives
Reporting Directives
Hash & Nonce Generator

For strict CSPs without 'unsafe-inline': hash inline script/style content, or generate a nonce and add it to the matching directive.

Live Preview

HTTP Header
Content-Security-Policy: default-src 'self'
Policy Value
default-src 'self'
Formatted (one directive per line)
default-src 'self';
Usage Snippets
nginx
add_header Content-Security-Policy "default-src 'self'" always;
Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'"

Build a Content Security Policy header by enabling directives and entering allowed sources. Copy the header value or the .htaccess snippet when done.

CSP Builder

Visual builder for Content Security Policy headers. Enable and configure 18 directives; add source expressions as chips; get live warnings for unsafe-inline and unsafe-eval; copy the ready-to-use header string. Also includes an Evaluate mode to paste an existing CSP header and get a graded security report.

Common uses

  • Build a CSP allowing scripts from a CDN
  • Configure a nonce-based script-src directive
  • Evaluate an existing CSP header for weaknesses

Frequently asked questions

Can I use CSP Builder to build a CSP allowing scripts from a CDN?

Yes. CSP Builder can build a CSP allowing scripts from a CDN, directly in your browser.

Can I use CSP Builder to configure a nonce-based script-src directive?

Yes. CSP Builder can configure a nonce-based script-src directive, directly in your browser.

Can I use CSP Builder to evaluate an existing CSP header for weaknesses?

Yes. CSP Builder can evaluate an existing CSP header for weaknesses, directly in your browser.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.