CSP Builder
Build a Content-Security-Policy header directive by directive, or paste the one you already have and get warnings about the settings that weaken it.
Runs in your browser — nothing is uploaded.
Check an existing policy
Paste the value of the header, or the whole “Content-Security-Policy: …” line.
Directives
Load http:// sub-resources over https://.
How to use it
- Start from the strict policy that is already loaded, or paste your current policy and press “Load policy”.
- For each directive tick the keywords you need and add hosts in the field below (for example https://cdn.example.com).
- Fix the warnings on the right, pick the output format (header, nginx, Apache, meta tag, Laravel) and copy the result.
- Test with “Report-Only” first: browsers log violations without blocking anything.
Frequently asked questions
Is my policy uploaded?
No. The policy is built and checked in your browser.
Why is “unsafe-inline” a problem?
It lets any inline script run, which is what a CSP is meant to stop. Use a nonce or a hash for the scripts you need instead. A browser that sees a nonce or hash ignores “unsafe-inline”, so keeping it is harmless only for old browsers.
What do object-src and base-uri do?
object-src 'none' blocks plugins such as Flash and Java applets, which can run script from a different origin. base-uri 'self' stops an attacker who can inject a <base> tag from changing where relative URLs point. Policies that only set script-src leave both open.
What does default-src do?
It is the fallback for every fetch directive you do not set yourself (images, fonts, connections, workers…). Frame-ancestors, base-uri and form-action do not fall back to it.
Can I use a meta tag?
Yes, but a meta tag cannot set frame-ancestors, report-uri or sandbox, and it only applies from the point where the tag appears. Prefer the HTTP header.
Does this tool guarantee my site is secure?
No. It flags common weak settings; it does not test your site. Try the policy in Report-Only mode and check your browser’s console before enforcing it.