CSP Header Generator
Build a Content Security Policy header interactively — configure directives, get server config snippets
Pick the sources you allow for scripts, styles, images, frames and other resource types, and the generator assembles a valid Content-Security-Policy header. It also outputs configuration snippets you can paste into common web servers. More free security tools.
A Content-Security-Policy header is only as good as its weakest directive — a single script-src 'unsafe-inline' or a wildcard host can undo the protection the rest of the policy provides against XSS and data injection. Building one by hand means tracking which directive governs which resource type (script-src, style-src, img-src, frame-src, connect-src and more) and getting the source-list syntax exactly right.
This generator lets you pick allowed sources per resource type and assembles a syntactically valid header, along with ready-to-paste configuration snippets for common web servers. Start as restrictive as your application allows — default-src 'self' plus explicit exceptions — rather than adding broad allowances and trying to narrow them later.
Need help implementing and monitoring CSP for your web applications?
If you like this tool, Speak with OneFirewall