CSP Header Generator

Pick per-directive sources, start from a strict preset and emit a ready-to-paste Content-Security-Policy header.

Build a Content-Security-Policy

Preset Report-Only header

default-src script-src

style-src img-src

font-src connect-src

frame-ancestors form-action

base-uri upgrade-insecure-requests

report-uri or report-to endpoint

Directives: 0

Header name: -

Test a new policy with report-only first, watch the reports, then enforce once the noise stops.

Start from a preset, or type the sources you need into each directive field.
Decide whether the header is enforced or report-only and add a report endpoint.
Click Build policy, then paste the header into your server or meta tag configuration.

Common questions about the free online csp header generator.

It is a response header that tells the browser which sources may load scripts, styles, images, frames and other resources.

Choose a preset or edit each directive, optionally add a report endpoint, then click Build policy and copy the header.

Start with default-src as a strict fallback, then add script-src, style-src and img-src for the sources your site really uses.

It sends violation reports without blocking anything, which is the safe way to test a policy before enforcing it.

It replaces the older frame options header and controls which sites may embed your pages, preventing clickjacking attacks.

It rewrites insecure subresource requests to HTTPS automatically, which removes mixed content warnings on secure pages.

Only with a nonce or hash. Allowing unsafe-inline defeats most of the protection that a policy provides.

Send it as a response header from your server, or set it with a meta tag when you cannot change the server configuration.

A missing source was blocked. Return to report-only, read the reports, and add only the sources you genuinely need.

Yes. The policy is assembled in your browser, nothing is uploaded, and the tool is free with no account or limits.

Last updated: October 10, 2026