CSP Header Generator
Build a Content-Security-Policy header with common directives and source keywords.
Live preview updates as you toggle options. Everything runs in your browser — nothing is sent to a server.
CSP generator controls
Reporting (optional)
Frequently asked questions
What is a Content-Security-Policy (CSP) header?
Content-Security-Policy is an HTTP response header that tells browsers which sources of script, style, images, and other resources a page may load. It helps mitigate XSS and data injection by restricting inline code and untrusted hosts.
What do 'self', 'none', and 'unsafe-inline' mean?
'self' allows the page’s own origin. 'none' blocks all sources for that directive. 'unsafe-inline' allows inline scripts or styles (weaker XSS protection). Prefer nonces or hashes over 'unsafe-inline' and 'unsafe-eval' when possible. Host wildcards like *.example.com match subdomains of that host only.
Header vs meta tag?
Prefer the HTTP header. A <meta http-equiv="Content-Security-Policy"> tag works for many directives but cannot enforce frame-ancestors, report-uri, or sandbox the same way. Use server config (nginx/Apache/CDN) for production.
Does my CSP policy leave my browser?
No. This generator runs entirely in your browser with JavaScript. Nothing is uploaded to a server.
Is this CSP header generator free?
Yes. The Formattly CSP Header Generator is free to use with no signup required.