CSP Generator
Build a Content-Security-Policy header directive by directive, not by editing a string.
Add a directive on the left.
How it works
Each line is one directive: a name followed by its source list, space-separated, the same grammar the header itself uses. The quick-add buttons insert a directive name with an empty source list to edit; the output assembles every non-empty line into a single header value in a fixed, spec-sensible order.
This is the opposite direction of the CSP Analyzer
The CSP Analyzer reads a policy you already have and reports what it does and does not restrict. This tool goes the other way — pick directives and sources, get a policy string. Paste the result into the Analyzer afterward as a second, independent check before deploying it.
Directives with no fallback
base-uri, form-action and frame-ancestors do not inherit from
default-src. Leaving any of them out does not restrict it at all, regardless of how strict
default-src is — the builder warns on exactly this.
Example
A minimal starting policy for a page with no inline script:
default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none';—
restrictive enough to catch most injection classes, permissive enough to be a starting point rather than a
finished policy.
Frequently asked questions
How is this different from the CSP Analyzer already on this site?
The Analyzer reads a policy you already have and reports what it does and does not restrict. This one goes the other direction: pick directives and sources, get a policy string out. Paste that string into the Analyzer afterward for a second, independent check.
Why does it warn me when base-uri, form-action or frame-ancestors is left blank?
None of the three fall back to default-src. A strict default-src with nothing else declared leaves all three completely unrestricted — an injected <base> tag can rewrite every relative URL on the page, and a form can submit to any origin.
Why warn about 'unsafe-inline' even though it's a valid keyword?
It defeats the point of the policy — inline script executes regardless of where it came from. The warning goes away once a nonce or hash source is also present in the same directive, because CSP Level 3 requires browsers to ignore 'unsafe-inline' entirely once one is.
Related tools
CSP Analyzer
Break a Content-Security-Policy into its directives and flag the weak ones.
LocalPermissions-Policy Builder
Turn on, off or origin-scope a browser feature per directive, then copy the header.
LocalSecurity Headers Analyzer
Review a set of pasted HTTP response headers against current guidance.
LocalSRI Hash Generator
Paste a script or stylesheet, get its sha256/sha384/sha512 integrity attribute.
LocalX.509 Certificate Decoder
Paste a PEM certificate to read its subject, issuer, validity, key and extensions.
LocalCSR Decoder
Paste a PKCS#10 CSR to read its requested subject, key and Subject Alternative Names.
Local