CSP

Content Security Policy Generator

Build a CSP header for HTML meta, nginx and Apache.

default-src

script-src

style-src

img-src

font-src

connect-src

media-src

frame-src

object-src

base-uri

form-action

frame-ancestors

upgrade-insecure-requests

Report URL (optional)

Report-only mode (test without blocking)

Result

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

# HTML (meta – frame-ancestors / report-uri are ignored in meta)
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests">

# nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;

# Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"

Runs entirely in your browser. Nothing is sent anywhere.

How it works

1Paste or type your text.
2Choose the options you need.
3Copy or download the result.

About this tool

Content Security Policy Generator: Build a CSP header for HTML meta, nginx and Apache. Paste your text and the result appears immediately, ready to copy or download. Everything happens locally in your browser — nothing you paste is uploaded or stored.

How do I use the Content Security Policy Generator?

Paste or type your text. Choose the options you need. Copy or download the result.

Is the Content Security Policy Generator free?

Yes. It is completely free with no sign-up, no usage limits and no watermark.

Is my data sent to a server?

No. Everything is calculated locally in your browser. Nothing you enter is uploaded, logged or stored.

Does it work on my phone?

Yes. It works in any modern browser on Android, iPhone, iPad, Windows, Mac and Linux — no app needed.

Content Security Policy Generator

How it works

About this tool

Related tools