Free online Content Security Policy (CSP) generator. Visually configure security policies to prevent XSS attacks and data injection. Supports all CSP directives. Generate HTTP header or meta tag code with one click.
1. Input: Enter or upload your content.
2. Process: Click the action button to process.
3. Get Results: View, copy, or download results.
CSP is a browser security mechanism that tells browsers which resources (scripts, styles, images) are allowed to load. It effectively prevents XSS attacks, data injection, and clickjacking.
Select resource types to restrict (script-src, style-src, img-src, etc.), set allowed sources (self, specific domains, CDNs), and the tool generates the complete CSP policy.
It can if misconfigured. Start with Report-Only mode (Content-Security-Policy-Report-Only), collect violation reports, then switch to enforcement. The tool supports strict-dynamic and nonce options.
We recommend HTTP response headers (more secure), but <meta http-equiv='Content-Security-Policy'> tags also work. This tool generates both formats.