CSP Header Generator

Content Security Policy (CSP) is an HTTP security header that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by controlling which resources the browser is allowed to load for a given page. A CSP Header Generator helps you build these policies visually without manually writing the header syntax.

CSP works by defining a set of directives that specify allowed sources for different resource types — scripts, styles, images, fonts, and more. When a page violates the policy, the browser either blocks the resource (enforce mode) or sends a report (report-only mode). Common use cases include securing web applications against XSS attacks, preventing clickjacking via frame-ancestors, enforcing HTTPS with upgrade-insecure-requests, and restricting plugin content with object-src 'none'.

1. Choose a preset — Select from Strict, Moderate, or Permissive presets to get started quickly, or configure each directive manually.
2. Enable directives — Check the directives you want (e.g., script-src, style-src, img-src) and enter the allowed sources.
3. Configure sources — Enter source expressions like 'self', https://example.com, 'unsafe-inline', or 'nonce-abc123'.
4. Copy the header — The generated CSP header appears in the output area. Click Copy to copy it to your clipboard and add it to your server configuration.