default-src
Default fallback source
Content Security Policy
CSP Generator and Checker
Build Content-Security-Policy headers with a visual directive table, or paste an existing policy and inspect it as structured data. Everything runs locally in your browser.
Frontend onlyLive headerStatic risk hints
Visual policy builder
Choose directives and add source values. The output updates in real time.
script-src
Script source
style-src
Style source
img-src
Image source
connect-src
Fetch and connection source
font-src
Font source
frame-src
Embedded frame source
object-src
Plugin object source
base-uri
Base tag source
form-action
Form submission target
frame-ancestors
Allowed parent pages
upgrade-insecure-requests
Upgrade HTTP subresource requests
This directive has no source values. When enabled, it is written directly into the policy.
CSP Header
CSP updatedGenerate or parse a policy and the CSP header will appear here.
Structured view
No enabled directives yet.
Local generation and static hints
This tool does not request target sites or inspect live response headers. Parsing, generation, risk hints, and copying all happen inside the current browser page.
Common uses
Pre-launch template
Create a practical CSP starting point with common directives, then tighten it for the real application.
Configuration review
Paste an existing policy to review directive sources and common high-risk patterns quickly.
Team handoff
Copy a standard header or structured directive view for frontend, security, and operations collaboration.
FAQ
Does this inspect a site's real response headers?
No. This page only processes the CSP string you enter and does not access target sites.
Can risk hints replace a security audit?
No. The hints only cover static rules such as wildcards, unsafe-* values, and missing key directives.
Why should 'none' not be mixed with other sources?
'none' means no source is allowed. Combining it with other sources is confusing, so it should stand alone.