Build CSP

Generate a Content-Security-Policy header from directives, sources, nonces, or hashes.

freeworks offlinenothing uploaded
ToolCSP Builder
Input
Output
—

How it works

Directives and source expressions become a CSP header, with nonces or hashes for inline scripts when selected. Omitted fetch directives can inherit default-src according to CSP fallback rules.

  • default-src self is a conservative start.
  • Script, style, and connect dependencies remain explicit.

Worked example

Strict CSP with self-only scripts and inline styles
Build a Content Security Policy that restricts scripts to same-origin while allowing inline styles
Input
											Default SRC: 'self'
Script SRC: 'self'
Style SRC: 'self' 'unsafe-inline'
Img SRC: 'self' data:
Font SRC: 'self'
Connect SRC: 'self'
Media SRC: 
Object SRC: 'none'
Frame SRC: 
Child SRC: 
Worker SRC: 
Form action: 'self'
Frame ancestors: 'none'
Base uri: 'self'
Upgrade insecure requests: true
Report uri:
Output
												# Content Security Policy Header

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; upgrade-insecure-requests

# HTML Meta Tag
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; upgrade-insecure-requests">

# Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self…

When to use this

Web apps, report-only tuning, and static sites generate CSP headers.

Edge cases

  • A nonce must be unique per response and match its script.
  • Specific directives override default-src.
  • Hashes cover exact inline bytes including whitespace.

References