What is a Content Security Policy?

It is an HTTP header that tells the browser exactly which sources may load scripts, styles, images, fonts, and frames on your page, which blocks most cross-site scripting (XSS) attacks.

Why does this tool warn about unsafe-inline?

The unsafe-inline source lets any inline script or style run, which removes most of the XSS protection CSP gives you. It is better to use nonces or hashes for the inline code you trust.

What is the difference between the Strict, Balanced, and Permissive presets?

Strict allows only your own domain and blocks frames and plugins; Balanced keeps your own domain plus HTTPS CDNs and inline styles for typical sites; Permissive is a starting policy for sites with many third-party embeds, which you should tighten over time.

Can I use the meta tag version instead of the HTTP header?

Mostly yes, but the frame-ancestors and report directives are ignored in meta tags, so use the real HTTP header on your server for full protection.

Is my policy configuration uploaded anywhere?

No. The policy is generated entirely in your browser; nothing is sent to any server.

CSP Security Header Builder

Pick sources for each directive below. Your Content-Security-Policy is generated live, with server snippets for Apache and Nginx.

Preset:

Strict: only your own domain, no frames, no plugins — strongest protection.

HTTP header

Meta tag version

Apache (.htaccess)

Nginx snippet

How to read a directive

'self' — only your own domain (same scheme and host).
'none' — blocks everything for that directive.
https: — any source over HTTPS.
data: / blob: — inline data URLs, useful for images.
'unsafe-inline' — allows inline scripts and styles; weakens XSS protection.
'unsafe-eval' — allows eval() and similar; avoid unless a library truly needs it.

CSP Security Header Builder

HTTP header

Meta tag version

Apache (.htaccess)

Nginx snippet

Related Tools

Regex Tester

JWT Decoder

Hash Generator

UUID Generator

Unix Timestamp Converter

HTML Formatter