Write a Content-Security-Policy header

default-src 'self'; script-src 'self' cdn.example.com — assemble a CSP from checkboxes instead of remembering the syntax.

Tools used in this guide

CSP header builder

The job

CSP tells the browser where scripts, styles, images, and connections may load from. The syntax is easy to misremember — which keyword needs quotes, which directive covers what.

Build

Tick allowed sources per directive and add hosts. The tool emits the header line and the <meta> equivalent; unsafe-inline/eval get flagged, and frame-ancestors is dropped from <meta> because meta cannot carry it.

Start strict: default-src 'none', then open only what the site needs.
'self' covers same-origin; add hosts for CDNs — they must be exact or *.domain wildcards.

Worked example

A static site with a CDN script reads: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline' — the unsafe-inline warning reminds you inline styles remain permitted.

Where it stops

Assembly, not audit: it concatenates what you pick and warns on the known-dangerous keywords — it does not verify your site actually works under the policy. Report-URI and nonce support are not in the builder.