CSP Builder

Visual builder for Content Security Policy headers. Enable and configure 18 directives; add source expressions as chips; get live warnings for unsafe-inline and unsafe-eval; copy the ready-to-use header string. Also includes an Evaluate mode to paste an existing CSP header and get a graded security report.

Content Security Policy Builder

1 directive enabled
Fetch Directives
'self'
Document Directives
Navigation Directives
Reporting Directives
Hash & Nonce Generator

For strict CSPs without 'unsafe-inline': hash inline script/style content, or generate a nonce and add it to the matching directive.

Live Preview

HTTP Header
Content-Security-Policy: default-src 'self'
Policy Value
default-src 'self'
Formatted (one directive per line)
default-src 'self';
Usage Snippets
nginx
add_header Content-Security-Policy "default-src 'self'" always;
Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'"

Build a Content Security Policy header by enabling directives and entering allowed sources. Copy the header value or the .htaccess snippet when done.

CSP Builder

Visual builder for Content Security Policy headers. Enable and configure 18 directives; add source expressions as chips; get live warnings for unsafe-inline and unsafe-eval; copy the ready-to-use header string. Also includes an Evaluate mode to paste an existing CSP header and get a graded security report.

Common uses

  • Build a CSP allowing scripts from a CDN
  • Configure a nonce-based script-src directive
  • Evaluate an existing CSP header for weaknesses

Also searched as

  • content security policy generator
  • csp header builder
  • csp evaluator online
  • analyze my csp
  • csp checker grade
  • script-src nonce example
  • csp unsafe-inline warning
  • frame-ancestors csp generator
  • csp for cdn scripts
  • create csp header
  • refused to load script csp fix

Frequently asked questions

How do I create a Content Security Policy header?

Use the Build tab to enable directives, add source expressions as chips, and copy the generated header string.

How can I evaluate an existing CSP?

Paste it into the Evaluate tab to get a graded security report highlighting weaknesses.

Why does my CSP warn about unsafe-inline?

unsafe-inline and unsafe-eval weaken XSS protection, so the builder flags them live. Nonces are a common safer alternative.

How many directives does it support?

The builder covers 18 CSP directives.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.