Content Security Policy Generator
A Content Security Policy tells browsers exactly which sources your site may load, which blocks injected scripts. Select your directives, enter the allowed sources, and copy the finished header straight to your server configuration.
Enter the allowed sources next to each directive (separated by spaces, e.g. 'self' https://cdn.example.com). If you leave one empty, that directive will not be included in the header.
HTTP Header
Meta tag version
Add the header to your server config (Nginx/Apache), or place the meta tag in the
<head>. Before deploying, test in Report-Only mode so your site is not blocked.
How to use
- Enter your base policy in default-src (usually
'self'). - Enter sources in the directives you need, leave the rest empty.
- Press "Generate CSP Header" and copy the header to your server.
Tips
- Start with a report-only header and read the violation reports before enforcing.
- 'self' is the safe default for most directives; add outside sources one at a time.
- Inline scripts will be blocked - move them to files or add hashes/nonces.
- After deploying, test the site fully: a strict policy can silently break fonts or widgets.