CSP Header Generator
Assemble a Content-Security-Policy header from the sources you allow.
Assemble a Content-Security-Policy header value from the sources you allow.
Header
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'
Calculations happen in your browser.
Worked example
default-src 'self', script-src 'self', style-src 'self', img-src 'self' data:, and connect-src 'self' join into one Content-Security-Policy value separated by semicolons.
FAQ
- Where do I put the result?
- In a Content-Security-Policy HTTP header, or in a meta tag. The page gives you the header value.
- What does 'self' allow?
- Resources loaded from the same origin as the page. It doesn’t allow inline scripts unless you add that source yourself.
- Will this header break my site?
- A strict policy can block inline scripts, analytics, and font hosts. Try it in report-only mode before you enforce it.