CSP Generator
Build a Content-Security-Policy with a per-directive visual editor. Outputs the header form and the <meta http-equiv> form, with live evaluation against Google CSP Evaluator heuristics.
Interactive tool
Directives
This directive does not take a source list. It is either present or absent.
What is the CSP Generator?
A visual editor for building a Content-Security-Policy. Add the directives you care about, pick keywords ('self', 'none', 'unsafe-inline', 'strict-dynamic'), schemes (https:, data:), and explicit hosts. The tool emits both the HTTP header form and the <meta http-equiv> form, and grades your policy live against Google CSP Evaluator-style heuristics.
How to Use the CSP Generator
- 1Start with one of the presets (Strict, Locked-down, GitHub Pages-style) or build from scratch
- 2Add directives one at a time. Multi-select keyword sources, scheme sources, and host expressions
- 3Watch the findings panel: HIGH findings are blockers, MEDIUM are SAFE-but-loose, LOW/INFO are advisory
- 4Copy the HTTP header line for your reverse proxy / framework, or the <meta> tag for static-site fallback
- 5Roll out as Content-Security-Policy-Report-Only first so violations surface without breaking the site
Key features
Every CSP 3 directive
default-src, script-src and its -elem/-attr variants, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, worker-src, manifest-src, base-uri, form-action, frame-ancestors, trusted-types, require-trusted-types-for, report-uri, report-to.
Header + meta-tag outputs
Use the header form for your reverse proxy / framework. The meta form is a fallback for static-site hosts that cannot set arbitrary headers.
Report-only mode
Get a ready-to-paste Content-Security-Policy-Report-Only header so you can monitor violations before flipping the switch.
Live evaluation
Findings panel mirrors Google CSP Evaluator: HIGH (script-src wildcards, missing object-src, unsafe-eval), MEDIUM (style-src 'unsafe-inline', short nonces, plain HTTP), LOW (missing reporting).
Source picker
Keywords, schemes, and host expressions are chip-selected rather than free-typed: fewer typos, fewer drift bugs.
Runs in your browser
Pure-client tool. The policy and the source URLs never leave your device.
Why use a CSP?
A Content-Security-Policy is the strongest in-browser defence against cross-site scripting. It tells the browser exactly which origins are allowed to load scripts, styles, images, and other resources, and refuses everything else. A well-tuned CSP makes XSS attacks nearly inert even when an attacker controls page content.
Common use cases
- Adding CSP to a new application before launch
- Tightening an existing policy that relies on 'unsafe-inline'
- Generating the report-only header for a staging environment
- Migrating to a nonce-based / strict-dynamic policy
- Producing the <meta> fallback for a static-site host (GitHub Pages, etc.) that cannot set headers
Header vs meta-tag delivery
- Header delivery is preferred. It applies before HTML parsing starts, and can include directives the meta form does not support (sandbox, frame-ancestors, report-uri).
- Meta delivery is a last-resort fallback for hosts that cannot set arbitrary response headers. It still works for most fetch directives.
Roll-out playbook
- 1. Build the policy you want and ship it as Content-Security-Policy-Report-Only first.
- 2. Configure a report endpoint (Sentry, Datadog, your own) to receive violation reports.
- 3. Fix every violation that turns up. Whitelist intentional origins, replace inline scripts with hashed/noncE-based external scripts.
- 4. Once reports go quiet for a week, flip the header to enforcing mode.
Tips & best practices
Always set object-src
Even if you don't use <object>/<embed>. Adding object-src 'none' costs nothing and closes a known plugin-based XSS vector.
Avoid wildcards in script-src
An * or https: in script-src lets any host serve scripts, equivalent to no script-src at all for an attacker who controls one allowlisted origin.
Pair nonces with strict-dynamic
Modern policies use a per-request nonce on inline scripts plus 'strict-dynamic' to let scripts load further scripts. Host allowlists become unnecessary.
Validate after rollout
Use the Zap.Tools CSP Evaluator (in the same release) to confirm the live header matches what you intended.
Privacy & security
This tool runs entirely in your browser. Your policy never leaves your device.
Related tools
- Favicon Generator
Generate a complete favicon bundle from an image, text, or emoji: multi-size .ico, PNG, Apple touch icon, manifest, and HTML snippet
SEO Tools
- Meta Description Generator
Write SEO meta descriptions with live character and pixel-width counts plus Google desktop, Google mobile, and Bing truncation previews. Optionally fetch and edit an existing description from a live URL.
SEO Tools
- Schema Markup Validator
Validate JSON-LD, Microdata, and RDFa schema markup against Google Rich Results criteria. Paste HTML or JSON-LD, or fetch from any URL: get per-block required-field reports.
SEO Tools
- Robots Meta Generator
Build a <meta name="robots"> tag and the matching X-Robots-Tag HTTP header. Combine noindex, nofollow, noarchive, nosnippet, max-snippet, max-image-preview, max-video-preview, and unavailable_after with per-engine support hints.
SEO Tools
- Hreflang Generator
Generate hreflang link tags and XML sitemap fragments for international sites, with BCP 47 validation, x-default support, and reciprocity checks.
SEO Tools
- HTML Meta and Heading Extractor
Extract every meta, title, link, canonical, and hreflang tag from an HTML page, or analyze the H1-H6 heading outline with accessibility flags. Paste HTML or fetch any URL.
SEO Tools
Frequently Asked Questions
What does the CSP Generator actually output?
Two outputs: the HTTP header line (Content-Security-Policy: ...) and the meta-tag fallback (<meta http-equiv="Content-Security-Policy" content="...">). Both encode the same policy.
Should I use the header or the <meta> tag?
Always prefer the header. It applies before HTML parsing starts and supports every directive. The meta tag is a last-resort fallback for static-site hosts that cannot set arbitrary response headers, and does not support frame-ancestors, sandbox, or report-uri.
What does "Report-Only" mean?
Content-Security-Policy-Report-Only sends violations to your reporting endpoint without blocking anything. Use it during rollout to surface unintended violations before flipping to enforcing mode.
Why does the tool flag wildcards as HIGH?
A * or https: in script-src lets any host serve scripts. If even one allowlisted origin gets compromised, the entire policy is bypassed. Google CSP Evaluator marks the same pattern as HIGH for the same reason.
Where do I configure report-to / Reporting-Endpoints?
In the same response, alongside the CSP header. Reporting-Endpoints: default="https://example.com/csp-report" plus a Content-Security-Policy: ...; report-to default;. The CSP Generator outputs the right report-to fragment for you.