Security Headers Generator (CSP)

What this tool does

Assemble a Content-Security-Policy from structured directive rows instead of writing the header by hand, add the other security response headers next to it, and copy the result in the format your host expects. The policy is generated on the right as you edit, and the footer checks it for the mistakes that most often make a policy useless or break a site. Everything runs in your browser.

Directives and presets

Each fetch directive (default-src, script-src, style-src and so on) is one row with a checkbox and a space-separated source list: keywords such as 'self', 'none', 'unsafe-inline' and 'strict-dynamic' must be quoted, host and scheme sources (https: or https://cdn.example.com) must not be. The same applies to the document and navigation directives (base-uri, form-action, frame-ancestors, sandbox) and to the reporting directives.

Presets fill the directive rows for a common setup: a static site with no inline scripts, a Next.js app using a nonce with 'strict-dynamic', a single-page app, or a site that pulls scripts and fonts from public CDNs. They replace the directive rows only — the other response headers stay as you set them. Clear resets everything.

The rows cover the directives most policies need. script-src-elem, script-src-attr, style-src-elem, style-src-attr, child-src, navigate-to and require-trusted-types-for are not in the builder, so add them by hand when your policy needs them.

Nonces and inline hashes

If your server renders a fresh nonce into each response, paste it in and add it to script-src or style-src as 'nonce-…'. A generated example is only a placeholder: a real nonce must be new for every response, so the audit reminds you when a placeholder is still in the policy. For inline scripts and styles you cannot move into a file, paste the exact contents into the hash box to get a 'sha256-…' source, then add it to either directive.

Other security headers

Next to the CSP you can enable X-Content-Type-Options: nosniff, a Referrer-Policy, X-Frame-Options, Strict-Transport-Security with its max-age, includeSubDomains and preload options, the cross-origin isolation headers (COOP, COEP, CORP), a Reporting-Endpoints value, and a Permissions-Policy where each browser feature is set to (), (self) or *.

Checking the policy

The footer lists what it finds, from high to informational: 'unsafe-inline' or 'unsafe-eval' in a script directive, plain http:, https: or data: schemes where they enable XSS, a missing object-src, script-src or base-uri, host allowlists that are easy to bypass, nonces that are too short, deprecated directives, and a missing reporting destination. Sources that a nonce or 'strict-dynamic' makes browsers ignore are reported as notes rather than problems, because the policy itself is fine.

Exporting

Pick the target: raw response headers, an HTML <meta> tag (CSP only, since a meta element cannot deliver Report-Only or the other headers), nginx add_header, a Cloudflare Pages or Netlify _headers file, Apache Header always set, or vercel.json. Copy puts the result on the clipboard and Download saves it under the matching filename. Your policy is remembered on this device when tool memory is enabled.