CSP Builder
Generate Content Security Policy headers visually — configure directives, use presets, export in any format
CSP Builder
Configure each directive below and copy the generated CSP policy in your preferred format.
Start from a Preset
Global Options
Directives0 / 13 configured
Fallback for all fetch directives not explicitly setKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for JavaScriptKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for stylesheetsKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for imagesKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid targets for fetch, XHR, WebSocketKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for fontsKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for nested browsing contexts (iframe)Keywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for audio and videoKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for plugins (Flash, etc.)Keywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid sources for Worker and SharedWorker scriptsKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid endpoints for form submissionsKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Valid parents that may embed this pageKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Restricts URLs for <base> elementKeywords
'none'
'self'
'unsafe-inline'
'unsafe-eval'
'strict-dynamic'
'report-sample'
↵ Enter
Tool Features
Build production-ready Content Security Policies
Visual Builder
Configure each CSP directive with checkboxes and inputs
Policy Presets
Start from Strict, Moderate, Development, or WordPress templates
Validation
Highlights conflicts and insecure combinations automatically
Export Formats
Copy as HTTP header, meta tag, or raw CSP string
Generated CSP Policy
Content-Security-Policy — configure directives above to update
HTTP Header
Content-Security-Policy: upgrade-insecure-requests
HTML Meta Tag
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
Raw Policy String
upgrade-insecure-requests