CSP Header Generator

Build a Content-Security-Policy header with common directives and source keywords. Live preview updates as you toggle options. Everything runs in your browser — nothing is sent to a server.

Reporting (optional)

report-uri report-to (group name)

Content-Security-Policy header value

HTML meta http-equiv (note: frame-ancestors is ignored in meta)

nginx snippet

Apache (mod_headers) snippet

How it works

Toggle CSP directives and source keywords ('self', 'none', hosts, and common unsafe flags) to build a Content-Security-Policy header value in real time. Presets jump to a basic or stricter starting point; Reset clears back to defaults.

Alongside the header string you get an HTML meta http-equiv snippet plus nginx and Apache examples so you can paste the policy into the layer that actually serves responses. Optional report-uri / report-to fields help when you are ready to collect violation reports.

The generator never uploads your policy draft — it only concatenates what you select in the page.

When to use this tool

Drafting a first CSP before wiring it in CDN, nginx, Apache, or app middleware
Comparing a loose vs strict preset while tightening XSS defenses
Producing copy-paste snippets for meta tags (with known meta limitations) and servers
Teaching teammates what 'self', 'none', and host lists mean

Tips

Prefer the HTTP header over meta in production; meta cannot enforce frame-ancestors the same way
Avoid 'unsafe-inline' / 'unsafe-eval' when nonces or hashes are feasible
Roll out with report-only / reporting endpoints before enforcing a strict policy

Frequently asked questions

What is a Content-Security-Policy (CSP) header?

Content-Security-Policy is an HTTP response header that tells browsers which sources of script, style, images, and other resources a page may load. It helps mitigate XSS and data injection by restricting inline code and untrusted hosts.

What do 'self', 'none', and 'unsafe-inline' mean?

'self' allows the page's own origin. 'none' blocks all sources for that directive. 'unsafe-inline' allows inline scripts or styles (weaker XSS protection). Prefer nonces or hashes over 'unsafe-inline' and 'unsafe-eval' when possible.

Does my CSP policy leave my browser?

No. This generator runs entirely in your browser with JavaScript. Nothing is uploaded to a server.

Is this CSP header generator free?

Yes. The Formattly CSP Header Generator is free to use with no signup required.

Header vs meta tag?

Prefer the HTTP header. A meta http-equiv Content-Security-Policy tag works for many directives but cannot enforce frame-ancestors, report-uri, or sandbox the same way. Use server config (nginx/Apache/CDN) for production.