🛡️CSP Header Generator

Generate Content Security Policy headers for your website.

About CSP Header Generator

CSP Header Generator helps you build a valid Content Security Policy header for your website by selecting trusted sources for scripts, styles, images, fonts, and other resource types through a guided interface. A properly configured CSP is one of the most effective defenses against cross-site scripting (XSS) attacks.

How to Use CSP Header Generator

1
Select your resource directives
Use the checkboxes and input fields to specify trusted sources for scripts (script-src), styles (style-src), images (img-src), fonts, and other directives.
2
Review the generated header
The tool assembles your selections into a valid Content-Security-Policy header string that you can preview and test.
3
Copy and deploy the header
Copy the generated header string and add it to your web server configuration, CDN settings, or HTML meta tag.

Common Use Cases

Hardening a new website against XSS attacks by implementing a CSP from launch
Developers updating an existing CSP to allow new trusted third-party resources
Security engineers generating CSP headers as part of a security audit remediation
Learning which directives to configure for a specific tech stack

Frequently Asked Questions

What is a Content Security Policy?

A Content Security Policy (CSP) is an HTTP response header that tells browsers which sources of content are trusted for your site. It prevents malicious scripts from being injected and executed via XSS attacks by blocking untrusted resource loads.

Will adding a strict CSP break my website?

A strict CSP can block resources that were previously loaded without restriction. Always test in report-only mode first using the Content-Security-Policy-Report-Only header, review the violations, and adjust the policy before enforcing it.

How do I add the CSP header to my website?

Add the generated Content-Security-Policy header to your web server configuration (Apache, Nginx), your CDN, or as a meta tag in your HTML. The tool provides the exact header string to copy.