CSP Generator
NewBuild a Content-Security-Policy header visually with per-directive source toggles.
CSP generator
Build a Content-Security-Policy header
Pick sources per directive and get a ready-to-paste CSP header or meta tag, generated live as you toggle options.
Frequently Asked Questions
Does it validate that my CSP will actually work on my site?
No. It only assembles the header string from the sources you select per directive; it cannot check whether your site's actual scripts, styles, or connections will be allowed by the policy you build.
Why are unsafe-inline and unsafe-eval offered if they are discouraged?
They are real CSP keywords some sites still need for compatibility. Offering them as checkboxes lets you choose deliberately, but the tool does not warn you when you enable a weaker setting.
What is the difference between the header output and the meta tag output?
They contain the same policy string. The header output is meant for a Content-Security-Policy HTTP response header, while the meta tag output is a fallback for static hosting where you cannot set custom headers.
Can I add my own domains?
Yes. Each directive has a free-text field for space-separated custom sources like https://cdn.example.com, which are appended alongside any checked keywords.
Does leaving a directive with no sources checked omit it from the output?
Yes. If a directive ends up with zero sources (all keywords unchecked and no custom text), it is left out of the generated policy entirely rather than being emitted empty.