CSP Header Builder
Free online csp header builder.
About This Tool
Content Security Policy (CSP) is an HTTP response header that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which content sources the browser should trust. A properly configured CSP dramatically reduces the attack surface of your web application.
This CSP header builder provides a visual interface for constructing Content Security Policy headers. Instead of manually writing complex policy strings, you enable directives and specify allowed sources through a structured form. The tool generates the complete CSP header value, ready to add to your web server configuration.
CSP directives control different resource types: default-src (fallback for all resource types), script-src (JavaScript), style-src (CSS), img-src (images), font-src (fonts), connect-src (AJAX, WebSocket, fetch), frame-src (iframes), media-src (audio/video), and object-src (plugins). Each directive accepts source values like 'self' (same origin), specific domains, 'unsafe-inline' (inline scripts/styles), and 'unsafe-eval' (eval function).
Implementing CSP is an iterative process. Start with a report-only mode (Content-Security-Policy-Report-Only header) to identify what would be blocked without actually blocking it. Gradually tighten the policy until it blocks unauthorized content while allowing legitimate resources. This tool helps you experiment with different configurations.
CSP is recommended by OWASP and required by various security compliance frameworks. Major browsers (Chrome, Firefox, Safari, Edge) fully support CSP Level 2 directives. The generated header can be added to your web server (Apache, Nginx), application framework (Express, Django), or CDN (Cloudflare, AWS CloudFront).
Frequently Asked Questions
What is a CSP Header Builder?
A CSP Header Builder helps you construct Content Security Policy HTTP headers visually. CSP headers tell browsers which content sources to trust, preventing XSS and injection attacks.
How do I build a CSP header?
Enable the directives you need (script-src, style-src, img-src, etc.) and specify allowed sources for each (e.g., 'self', specific domains). The tool generates the complete header value to add to your server configuration.
Is this CSP builder free?
Yes, it's completely free. All policy construction happens in your browser — no data is sent to any server.
What is the difference between CSP and Content-Security-Policy-Report-Only?
Content-Security-Policy enforces the rules — browsers block unauthorized resources. Content-Security-Policy-Report-Only only reports violations without blocking, letting you test a policy before enforcing it. Start with report-only mode and switch to enforcing once your policy is tuned.
Related Tools
CSP Header Builder
Free online csp header builder.