Content-Security-Policy (CSP) Builder
Build a Content-Security-Policy header value directive by directive, toggle common sources, and add your own domains.
About this tool
A Content-Security-Policy tells the browser where a page may load scripts, styles, images and other resources from, which limits the damage from cross-site scripting (XSS) and data-injection attacks. Pick sources for each directive, or type your own (domains such as https://cdn.example.com, or nonces and hashes such as 'nonce-abc123'). Directives you leave empty are left out, and fall back to default-src. The starting point is a sensible baseline: default-src 'self', object-src 'none' and base-uri 'self'.
Warnings appear as you go for common mistakes, such as allowing 'unsafe-inline' scripts or combining 'none' with other sources. Sending the policy as an HTTP Content-Security-Policy header is the better option; the <meta> tag version works for most directives but browsers ignore frame-ancestors there, so it is left out of the tag. Test a new policy with the Content-Security-Policy-Report-Only header first, since an overly strict policy can quietly break scripts, styles or embeds.