CSP Builder
Build and analyze Content-Security-Policy headers visually.
Generated Header
default-src 'self'
Add to your server:
Content-Security-Policy: default-src 'self' Fallback for all resource types
'self'
JavaScript sources
CSS stylesheet sources
Image sources
Font file sources
XHR, fetch, WebSocket origins
Audio and video sources
Plugin sources (Flash, Java)
iframe sources
Who can embed this page
Restrict <base> element URLs
Form submission targets
Web Worker sources
App manifest sources
Related Tools
H> HTTP Header Analyzer
Analyze HTTP headers for security issues, caching behavior, and CORS configuration with fix snippets.
H# HTTP Status Codes
Look up HTTP status codes. 401 vs 403, 502 vs 503, and search by name or number.
IP IP / CIDR Calculator
Calculate subnets, host ranges, and masks for IPv4 CIDR notation with visual binary breakdown.
How to Build a Content-Security-Policy Header
A Content-Security-Policy header tells browsers which scripts, styles, images, and frames are allowed. This builder generates directives visually and flags risky values like unsafe-inline and unsafe-eval.
CSP is one of the highest-impact HTTP security headers. After you generate a policy, paste your full response headers into the HTTP header analyzer to see how CSP sits next to HSTS, frame-ancestors, and CORS.
Tips
- Start with a Report-Only policy in production so you can see violations before you enforce.
- Prefer nonces or hashes over
unsafe-inlinefor scripts. default-src 'self'is a reasonable starting default-src; then add only what you need.