CSP Policy Builder
Assemble CSP directives and sources into enforce or report-only headers, with deployment-format output and guardrails.
Start with a policy shape, not a promise
Presets are editable starting points. They cannot know which scripts, APIs, frames, fonts, or inline code your application actually needs.
Source shortcuts with narrow destinations
These buttons add example origins only to the directives where they normally belong. Real deployments can need different hosts, so compare the result with your own network traffic.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Space-separated CSP source expressions only. Raw semicolons and commas are rejected so one field cannot accidentally create another directive.
Violation reporting
report-to names a reporting endpoint group defined separately in a Reporting-Endpoints response header. report-uri accepts report URLs but is deprecated and remains here only for compatibility.
Things worth checking before deployment
HTTP resource URLs will be rewritten
upgrade-insecure-requests upgrades insecure subresource URLs to HTTPS. A resource that has no HTTPS endpoint can then fail to load.
Generated policy
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
Start from the requests your page really makes
CSP works best when the allowlist reflects actual application behavior. Browser network logs, report-only violations, framework output, third-party widgets, and inline code all matter more than a generic preset. A host-based policy can still be broad even when it looks tidy on one line.
Host allowlists and strict CSP solve different maintenance problems
Modern strict CSP guidance commonly relies on per-response nonces or stable script hashes, often together with'strict-dynamic'. That model cannot be generated safely from a static hostname list because the nonce must be unpredictable and coordinated with the HTML response. Add nonce or hash expressions here only when your application actually supplies the matching values.
Report-only is observation, not protection
A report-only policy records violations but does not block the violating load. The report-to directive names a group defined by the separate Reporting-Endpoints header; it is not itself a report URL. report-uri is deprecated, but many deployments still send both while older browser support matters.
Meta output intentionally leaves some directives behind
A CSP meta element cannot deliver report-only mode, and browsers do not support frame-ancestors or CSP reporting directives from that element. When Meta Tag output is selected, this builder omits those directives instead of producing markup that looks valid but will be ignored.
Why block-all-mixed-content is not offered here
The directive is obsolete in current specifications. Modern mixed content handling already upgrades or blocks affected requests, and upgrade-insecure-requests remains available when a site needs CSP to rewrite insecure subresource URLs to HTTPS.
Generated configuration still needs application testing
The builder checks obvious policy-construction mistakes, but it cannot discover every resource your application loads or determine whether a permitted origin can serve attacker-controlled code. Test in report-only mode, inspect violations, then enforce deliberately.
Specification and browser guidance
Directive syntax and fallback behavior come from Content Security Policy Level 3. The MDN CSP implementation guide is useful for nonce/hash deployment, report-only testing, and browser behavior.