How to use the CSP Generator
- Tick the services your site uses (analytics, fonts, video embeds, payments). Their hosts are added to the right directives.
- Adjust any directive — for example add your own CDN to
script-srcorimg-src. - Start with Report-only on a live site: browsers log violations without blocking anything.
- Copy the policy as a header, meta tag or server config, deploy it, and check the browser console for blocked resources.
What a Content Security Policy does
A Content-Security-Policy (CSP) tells the browser which sources a page may load scripts, styles, images, fonts, frames and connections from. If an attacker injects a <script> (cross-site scripting), the browser refuses to run it because its source isn’t allowed. It is one of the most effective defenses against XSS and data theft.
Key directives
| Directive | Controls |
|---|---|
default-src | Fallback for every resource type you don’t list |
script-src | JavaScript — the most important one |
style-src, img-src, font-src | CSS, images and web fonts |
connect-src | fetch, XHR, WebSocket and analytics beacons |
frame-src / frame-ancestors | Which iframes you embed / who may embed your page (clickjacking) |
object-src 'none', base-uri 'self' | Close two classic XSS bypasses — always set them |
Rolling it out safely
Deploy with Content-Security-Policy-Report-Only first and watch the browser console (or a report-to endpoint) for a few days. Fix what breaks, then switch to the enforcing header. Avoid 'unsafe-inline' and 'unsafe-eval' in script-src; use nonces or hashes for the few inline scripts you need.
Check a live site with the Security Headers Checker.
Also searched as: content security policy generator, csp header, content-security-policy builder, csp nginx, csp meta tag, script-src, csp google analytics, csp report-only.
Tools that pair well with the CSP Generator
- .htaccess Generator — Tick the rules you need — HTTPS, canonical host, redirects, compression, caching, security headers, protected files — and get a clean, commented .htaccess file.
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- security.txt Generator — Fill in a few fields to generate a standards-compliant /.well-known/security.txt that tells researchers how to report security issues to you.
- Redirect Generator — Paste your old and new URLs (from a spreadsheet, CSV or two columns) and get redirect rules for your server or platform — plus checks for chains, loops, duplicates and trailing-slash traps before you go live.