What is the CSP Generator?
This tool builds a Content Security Policy header by letting you pick which sources are allowed for scripts, styles, images, fonts, connections, and frames. It outputs both the raw HTTP header value and an equivalent meta tag you can paste into your HTML.
How to Use This CSP Generator
- For each directive, check 'self' to allow same-origin resources, and add any third-party domains you need.
- Avoid checking 'unsafe-inline' or 'unsafe-eval' for script-src unless absolutely necessary — both weaken your XSS protection.
- Optionally add a report-uri to collect violation reports.
- Click Generate CSP, then copy the header or meta tag version.
When Do You Need a CSP?
A Content Security Policy is one of the most effective browser-level defenses against cross-site scripting and data injection attacks. Any site that loads third-party scripts, fonts, or embeds should define an explicit CSP rather than relying on default browser behavior.
Frequently Asked Questions
What is a Content Security Policy?
A Content Security Policy (CSP) is an HTTP header that tells the browser which sources of scripts, styles, images, and other resources are allowed to load on a page, reducing the risk of cross-site scripting and data injection attacks.
Does CSP prevent XSS?
CSP significantly reduces the impact of XSS by blocking inline scripts and untrusted sources by default, but it isn't a complete substitute for proper input sanitization and output encoding — it's a defense-in-depth layer.
unsafe-inline vs nonces?
'unsafe-inline' allows any inline script or style to run, which defeats much of CSP's XSS protection. Nonces let you allow specific inline scripts by adding a unique, server-generated token to each one, which is far more secure.
How to test your CSP?
Deploy your policy using the Content-Security-Policy-Report-Only header first, which logs violations to the browser console (and optionally a report-uri endpoint) without blocking anything, so you can fix issues before enforcing the policy.