Free tool · No sign-up

Content Security Policy generator

Updated 2 November 2026

Fill in the outside services your site loads, tick a few options and copy a ready Content-Security-Policy for your server. Everything runs in your browser; nothing is sent to us. Start in Report-Only mode, then switch to enforcing once nothing breaks.

What CSP protects against

A Content Security Policy is a response header that lists where a page may load scripts, styles, images, fonts, frames and network requests from. If an attacker manages to inject a <script> tag through a comment form or a compromised plugin, the browser refuses to run it because its source isn't on the list. That makes CSP one of the strongest defences against cross-site scripting (XSS) and against malicious scripts that skim card details.

How to use the generated policy safely

Start with Report-Only. The Content-Security-Policy-Report-Only header blocks nothing. It only logs violations in the browser console, and to a report URL if you set one.
Browse your whole site with the developer console open: checkout, forms, logged-in pages, embedded videos. Every violation names the blocked source. Add the hosts you really use.
Switch to enforcing by renaming the header to Content-Security-Policy.
Re-run the free headers check to confirm the header is live.

What the defaults mean

default-src 'self': anything not listed may load only from your own origin.
object-src 'none': blocks old plugin content such as Flash, a frequent bypass.
base-uri 'self': stops injected <base> tags from redirecting relative script URLs.
frame-ancestors 'none': other sites can't put your pages in a frame, which prevents clickjacking. It replaces X-Frame-Options in modern browsers. Use 'self' if you frame your own pages.
upgrade-insecure-requests: old http:// links to images and scripts are fetched over https.

About 'unsafe-inline'

Many sites need 'unsafe-inline' for styles at first, which is a moderate risk. For scripts it removes most of the XSS protection, because an injected inline script then runs. Move inline scripts into files, or use a nonce or hash per script, when you can. Analytics and tag managers each document the hosts their snippet needs.

The meta-tag version is a fallback for hosts that don't let you set headers. Browsers ignore frame-ancestors, report-uri and sandbox in a meta tag, so the generator leaves those out.

Frequently asked questions

Will a CSP break my site?

An enforcing policy that misses a host will block that resource. That's why the generator defaults to Report-Only: watch the console for a week, add the hosts you need, then enforce.

Is a meta tag as good as the header?

Almost. A meta tag can't set frame-ancestors or reporting, and it only applies to content after it in the page. Use the header when you can.

Do I still need X-Frame-Options if I set frame-ancestors?

Modern browsers prefer frame-ancestors. Keeping X-Frame-Options: DENY or SAMEORIGIN as well is harmless and covers very old browsers.

Does this tool send my settings anywhere?

No. The policy is built in your browser and nothing is sent to our server.