SSL & Web Headers100% In-BrowserCSP Builder
CSP (Content Security Policy) Generator
Visual rule builder to create robust Content-Security-Policy headers restricting script, style, and media sources.
Real-time processing·No server uploads·Zero telemetry
csp-(content-security-policy)-generator
LIVE
CSP Directives
default-srcFallback for all resource typesscript-srcJavaScript execution sourcesstyle-srcStylesheet sourcesimg-srcImage sourcesconnect-srcXHR/fetch/WebSocket endpointsobject-srcPlugin content (Flash, etc.)frame-ancestorsWhich pages may embed this pagereport-uriGenerated CSP Header
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;
Nginx / Apache Usage
# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;" always;
# Apache (.htaccess):
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;"
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;" always;
# Apache (.htaccess):
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;"
How to Use CSP (Content Security Policy) Generator
01
Toggle allowed directives (self, none, trusted CDNs, Google Fonts).
02
Configure script-src, style-src, and connect-src rules.
03
Copy the generated Content-Security-Policy header string.
Privacy Guarantee
CSP (Content Security Policy) Generator runs 100% client-side in your web browser. Your data, passwords, keys, and files are processed using the Web Crypto API and never transmitted to any server. Zero telemetry, zero storage, zero cloud processing.
Frequently Asked Questions
How does CSP block XSS attacks?
By restricting where scripts can load from and disabling inline eval(), browsers reject injected scripts.
Discover More