Policy inputs
Choose exactly what your site may load
Separate sources with spaces, commas, or new lines. Start with a preset, then replace broad schemes with exact origins.
Free developer tool
Free Content Security Policy Generator
A Content Security Policy generator turns the resource origins your site needs into a deployable CSP header. Build a policy, inspect risky choices, and copy server-ready configuration without sending your inputs anywhere.
Runs in your browserNo signupHeader injection checksReport-only workflow
Deployment output
Copy-ready CSP header
Review every origin and test in report-only mode. CSP reduces injection impact, but it does not replace output escaping.
Header name
Content-Security-PolicyServer configuration
Paste into the matching host configuration, then reload it.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https:; frame-src 'none'; media-src 'self' blob:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests;" always;
Policy review
14 directives · 1 warningsunsafe-inline in style-src is common for legacy styles, but nonces or hashes provide tighter control.
How to build and deploy a CSP
- 1Choose a starting presetSelect the strict static, modern app, SPA and API, or embedded-content baseline closest to your site.
- 2List exact resource sourcesAdd the origins, schemes, nonces, and hashes required for scripts, styles, images, fonts, API calls, frames, workers, and media.
- 3Generate and review warningsCreate the header, remove wildcards or unsafe sources where possible, and confirm each remaining origin is intentional.
- 4Deploy in report-only modeAdd a reporting endpoint, exercise real user flows, and fix legitimate violations before enforcement.
- 5Copy the server configurationUse the Nginx, Apache, Netlify, or Vercel snippet, reload the site, and verify the response header in browser developer tools.
Prefer exact origins
Replace broad HTTPS schemes and wildcards with the specific hosts your application actually contacts.
Use nonces or hashes
Nonces and hashes authorize known inline code without granting blanket permission through unsafe-inline.
Test complete user flows
Exercise authentication, payments, uploads, analytics, workers, and error tracking before switching from reports to blocking.
Content Security Policy generator FAQ
What is a Content Security Policy generator?
A Content Security Policy generator builds a CSP response header from the resource origins your site needs. It formats directives such as script-src, style-src, img-src, connect-src, and frame-ancestors so you can test and deploy the policy.
Should I start with CSP report-only mode?
Yes, for an existing site. Report-only mode records violations without blocking resources, which lets you discover required origins and inline code before turning enforcement on.
Is unsafe-inline safe in a CSP?
No. unsafe-inline weakens script or style protection because it allows inline code broadly. Prefer a unique nonce or an approved hash when your framework and deployment setup support them.
Can I use a CSP meta tag instead of an HTTP header?
A meta tag supports only part of CSP and cannot use features such as report-only mode or frame-ancestors. A response header is the recommended deployment method.
Will a generated CSP automatically secure my site?
No. A CSP reduces the impact of some injection attacks, but it must match the real application and does not replace escaping, validation, dependency updates, secure cookies, or server-side controls.
Keep building
Turn verified deployment steps into a Tornic workflow
Tornic runs deterministic multi-step workflows through the AI coding CLIs you already use, with explicit checks and human approval gates.
Explore Tornic