Csp Header Generator
Visually build Content-Security-Policy headers. Toggle directives, pick sources, and copy the result.
Enable directives below to generate a CSP header
CSP Quick Reference
- 'self' — Same origin only (scheme + host + port)
- 'none' — Block everything for this directive
- 'unsafe-inline' — Allow inline scripts/styles (weakens CSP)
- 'unsafe-eval' — Allow eval() and similar (weakens CSP)
- 'strict-dynamic' — Trust scripts loaded by already-trusted scripts
- https: — Allow any HTTPS source
- data: — Allow data: URIs (use cautiously)
- blob: — Allow blob: URIs