Comment utiliser : CSP Generator
- Tick the services your site uses (analytics, fonts, video embeds, payments). Their hosts are added to the right directives.
- Adjust any directive — for example add your own CDN to
script-srcorimg-src. - Start with Report-only on a live site: browsers log violations without blocking anything.
- Copy the policy as a header, meta tag or server config, deploy it, and check the browser console for blocked resources.
What a Content Security Policy does
A Content-Security-Policy (CSP) tells the browser which sources a page may load scripts, styles, images, fonts, frames and connections from. If an attacker injects a <script> (cross-site scripting), the browser refuses to run it because its source isn’t allowed. It is one of the most effective defenses against XSS and data theft.
Key directives
| Directive | Controls |
|---|---|
default-src | Fallback for every resource type you don’t list |
script-src | JavaScript — the most important one |
style-src, img-src, font-src | CSS, images and web fonts |
connect-src | fetch, XHR, WebSocket and analytics beacons |
frame-src / frame-ancestors | Which iframes you embed / who may embed your page (clickjacking) |
object-src 'none', base-uri 'self' | Close two classic XSS bypasses — always set them |
Rolling it out safely
Deploy with Content-Security-Policy-Report-Only first and watch the browser console (or a report-to endpoint) for a few days. Fix what breaks, then switch to the enforcing header. Avoid 'unsafe-inline' and 'unsafe-eval' in script-src; use nonces or hashes for the few inline scripts you need.
Check a live site with the Security Headers Checker.
Aussi recherché comme : content security policy generator, csp header, content-security-policy builder, csp nginx, csp meta tag, script-src, csp google analytics, csp report-only.
Outils complémentaires : CSP Generator
- .htaccess Generator — Tick the rules you need — HTTPS, canonical host, redirects, compression, caching, security headers, protected files — and get a clean, commented .htaccess file.
- Générateur de configuration Nginx — Choisissez ce que Nginx doit faire — servir un site statique ou une application SPA, agir en tant que proxy vers une application Node/Python, ou exécuter du code PHP — et cochez les options supplémentaires.
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- security.txt Generator — Fill in a few fields to generate a standards-compliant /.well-known/security.txt that tells researchers how to report security issues to you.