Content Security Policy Generator
Build a Content-Security-Policy header, meta tag and Report-Only version with presets, nonces and SHA-256 hashes, and audit an existing policy.
Start from a preset
The Google hosts are examples taken from Google's CSP guidance for the Google tag. Google changes them from time to time: check the current documentation and remove what you don't use.
In a <meta> tag browsers ignore frame-ancestors, report-uri, report-to and sandbox, and Report-Only is not supported. Put the tag at the top of <head>: it only applies to content that comes after it.
Review of this policy
No weaknesses found by these checks.
Evaluate an existing policy
How to build a policy
- Pick a starting point under Start from a preset: Strict (nonce + strict-dynamic), Locked-down static site, Typical website or Typical + Google Analytics / Ads. The editor opens with the typical website preset.
- Adjust the Directives. Each field takes space-separated sources; an empty field leaves the directive out.
- Use Quick add to append a keyword to the chosen Directive:
'self','none','unsafe-inline','strict-dynamic',https:,data:… Add a nonce inserts a random 128-bit nonce. - To allow a specific inline script without
'unsafe-inline', paste it (or the HTML around it) in Hash an inline script or style and click Compute SHA-256 and add. - Tick upgrade-insecure-requests if some old URLs still use
http://, and optionally enter a Report endpoint URL. - Copy the HTTP header, the Report-Only header or the HTML tag. The Review of this policy updates as you type.
To audit a policy you already have, paste it under Evaluate an existing policy and click Evaluate policy; Load into the editor copies it into the fields.
What a Content Security Policy does
A CSP tells the browser which origins a page may load scripts, styles, images, fonts, frames and connections from. Its main job is to limit cross-site scripting (XSS): even if an attacker injects markup into your page, a good policy stops the injected script from running. It also controls who can frame your page (frame-ancestors), where forms can post (form-action) and what <base> can point to (base-uri).
Fetch directives such as img-src or font-src fall back to default-src when they are missing. base-uri, form-action and frame-ancestors don’t fall back, which is why the review asks for them explicitly.
Nonces, hashes and strict-dynamic
Allowing hosts (script-src https://cdn.example.com) looks safe but is often bypassable: big domains host JSONP endpoints and old libraries that an attacker can reuse. The approach recommended by browser security teams is a strict CSP: every legitimate <script> carries a nonce generated by the server for each response, or is allowed by its hash, and 'strict-dynamic' lets those trusted scripts load the scripts they need. In that setup https: and 'unsafe-inline' are only fallbacks for very old browsers; modern ones ignore them.
A nonce only works if it changes on every response and is unpredictable. The one inserted by Add a nonce is an example: your server or framework must generate its own. A hash covers the exact bytes of the inline code, so reformatting the script requires a new hash.
Header, Report-Only and meta tag
Send the policy as an HTTP response header whenever you can. Deploy it first as Content-Security-Policy-Report-Only: browsers report violations (to the console, and to your endpoint if you set one) without blocking anything, so you can fix your pages before enforcing. The report settings add report-uri for older browsers and report-to with a Reporting-Endpoints header.
The <meta http-equiv> version is handy on static hosting, but browsers ignore frame-ancestors, report-uri, report-to and sandbox in it, and there is no Report-Only meta tag. The tool removes those directives from the tag and says so.
Frequently asked questions
Is 'unsafe-inline' in style-src a problem?
It is less dangerous than in script-src and very common, because many libraries set inline styles. Injected CSS can still deface a page or leak data, so the review lists it as low severity.
Are the Google Analytics hosts complete?
They are examples from Google’s CSP guidance for the Google tag. Google adjusts them over time and regional domains may be needed; check Google’s current documentation and remove what you don’t use. The gtag.js inline snippet also needs a nonce or hash.
Why is my policy blocking my own inline scripts?
Once script-src is set without 'unsafe-inline', every inline <script> and onclick= attribute is blocked. Move the code to a file, or add a nonce or a hash.
Does a CSP replace escaping user input?
No. A CSP is a second line of defence. Keep escaping output and validating input; the policy limits the damage when something slips through.
Can I have several policies?
Yes: if a page receives several CSP headers, a resource must satisfy all of them. Paste one policy at a time into the evaluator.
Related tools
- .htaccess Redirect Generator Generate 301 and 302 redirects for .htaccess or Nginx, force HTTPS and www, move a domain and fix trailing slashes, with checks for loops and chains.
- Meta Tag Generator Free meta tag generator for the title, meta description, canonical URL, robots and viewport tags, with length checks and correctly escaped HTML.
- Hash Generator Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files of any size, and verify checksums. Everything runs in your browser.
- Robots.txt Generator Create a valid robots.txt file with user-agent groups, Allow and Disallow rules, sitemaps and crawl-delay, with checks for common mistakes.