← All Tools

CSP Builder

Build, paste-and-lint and security-review a Content-Security-Policy — entirely in your browser, nothing is uploaded.

Roll out safely. A new CSP can break a working site. Deploy it first with the Content-Security-Policy-Report-Only header, watch the violation reports, fix what it would block, then switch to the enforcing Content-Security-Policy header. Policy logic follows W3C CSP Level 3.

Directives

Separate multiple sources with spaces. Keywords must be quoted, e.g. 'self'.

Generated policy

HTTP header

Content-Security-Policy: default-src 'self'

<meta> tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'">

Analysis

Import & lint an existing policy

Paste a Content-Security-Policy value (the header name is optional). It will be loaded into the builder above and checked for syntax and security problems.

Source keywords & schemes

'self'Same origin only

'none'Block everything (use alone)

'nonce-…'One per-request random token

'sha256-…'Hash of an allowed inline block

'strict-dynamic'Trust scripts loaded by trusted scripts

'unsafe-inline'Risky: allows inline scripts/styles

'unsafe-eval'Risky: allows eval() / new Function()

'wasm-unsafe-eval'Allow WebAssembly compilation only

https:Any host over HTTPS (broad)

data:data: URIs (avoid for scripts)

*.example.comAny subdomain

cdn.example.com:443A specific host and port

🛡 CSP Builder