CSP Header Generator - Build a Content-Security-Policy Online
CSP Header Generator
Build a Content-Security-Policy Header from Directives
Leave any directive blank to omit it. Separate multiple sources with spaces (e.g. 'self' https://cdn.example.com).
Understanding Content-Security-Policy
XSS Mitigation
CSP is one of the strongest browser-enforced defenses against cross-site scripting, restricting where scripts can load from.
Allowlist Model
Each directive defines an explicit allowlist of sources for a resource type — anything not listed is blocked by default.
Clickjacking Defense
frame-ancestors controls which sites can embed your page in an iframe, replacing the older X-Frame-Options header.
Local Processing
Your directive values never leave your browser — the header string is assembled entirely client-side.
Testing Before Enforcing
A misconfigured CSP can silently break legitimate scripts, styles, or images on your site. Before setting the generated string as a Content-Security-Policy header, consider deploying it first as Content-Security-Policy-Report-Only — this reports violations to the browser console without actually blocking anything, letting you catch gaps before enforcing the policy for real.
Key Takeaways
- 11 Common Directives: Covers the directives most sites need, from script-src to form-action.
- Omit What You Don't Need: Blank directives are simply left out of the final header string.
- Client-Side Only: All assembly happens locally in your browser — no data is ever sent to a server.