Content Security Policy Generator
Fill in sources for each CSP directive to generate a ready-to-use Content-Security-Policy header value and meta tag.
Inputs
Header value
Meta tag
Leave a field empty to omit that directive entirely. Separate multiple sources with spaces.
How to build a Content-Security-Policy
Fill in sources for each directive to generate a Content-Security-Policy header value and an equivalent meta tag.
How it works
Each directive you fill in becomes one clause in the policy, separated by semicolons. A directive left empty is omitted entirely, which is different from setting it to block everything.
Common uses
- Draft a starting policy for a new project.
- See the exact header string to paste into your server configuration or reverse proxy.
Good to know
- This tool builds the policy string only — it doesn't verify that your site actually works under the policy you create.
- Test a new policy in "Content-Security-Policy-Report-Only" mode before enforcing it, to catch anything it would unexpectedly block.
Calculation notes
All generation runs in your browser; the values you enter are never sent anywhere.
FAQ
What does 'self' mean as a source?
'self' allows resources from the same origin (scheme, host, and port) as the page itself. Keep the quotes — they're part of the CSP syntax.
Should I use the header or the meta tag?
The HTTP header is the more complete and recommended option — some directives, like frame-ancestors, only work in the header, not in a meta tag.
Will this policy block inline scripts and styles?
Yes, by default — add 'unsafe-inline' (less secure) or a nonce/hash-based source to script-src or style-src if your page relies on inline code.