MobiflixPro
SSL & Web Headers100% In-BrowserCSP Builder

CSP (Content Security Policy) Generator

Visual rule builder to create robust Content-Security-Policy headers restricting script, style, and media sources.

Real-time processing·No server uploads·Zero telemetry
csp-(content-security-policy)-generator
LIVE
CSP Directives
default-srcFallback for all resource types
script-srcJavaScript execution sources
style-srcStylesheet sources
img-srcImage sources
connect-srcXHR/fetch/WebSocket endpoints
object-srcPlugin content (Flash, etc.)
frame-ancestorsWhich pages may embed this page
report-uri
Generated CSP Header
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;
Nginx / Apache Usage
# Nginx:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;" always;

# Apache (.htaccess):
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;"

How to Use CSP (Content Security Policy) Generator

01

Toggle allowed directives (self, none, trusted CDNs, Google Fonts).

02

Configure script-src, style-src, and connect-src rules.

03

Copy the generated Content-Security-Policy header string.

Privacy Guarantee

CSP (Content Security Policy) Generator runs 100% client-side in your web browser. Your data, passwords, keys, and files are processed using the Web Crypto API and never transmitted to any server. Zero telemetry, zero storage, zero cloud processing.

Frequently Asked Questions

How does CSP block XSS attacks?

By restricting where scripts can load from and disabling inline eval(), browsers reject injected scripts.

Discover More

Related Security Tools

View All Security Tools
SSL & Web Headers

SSL Certificate & Expiry Checker

Inspect SSL/TLS certificate validity, expiration date, issuer CA, SAN domains, and days remaining.

SSL & Web Headers

TLS Configuration Checker

Evaluate supported TLS versions (TLS 1.2, TLS 1.3), cipher suites, and obsolete protocol risks.

SSL & Web Headers

HTTPS & Redirect Chain Checker

Trace HTTP to HTTPS redirects, detect insecure mixed-content hops, and verify 301 permanent rules.

SSL & Web Headers

Security Headers Inspector

Scan web servers for critical headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.

SSL & Web Headers

HTTP Header Analyzer

Inspect raw response headers, caching directives, server signatures, and potential information leaks.

SSL & Web Headers

CSP Policy Validator

Audit existing Content Security Policy strings for unsafe-inline, wildcard (*), and bypass vulnerabilities.