CSP header builder

Compose a Content-Security-Policy header from per-directive checkboxes and host lists — with the <meta> equivalent and inline/eval warnings.

Check the sources each directive may load from and list extra hosts (space-separated).

default-src
script-src
style-src
img-src
font-src
connect-src
frame-src
frame-ancestors
object-src
base-uri
form-action
media-src
worker-src
manifest-src
Also emit

Everything runs in this browser.

How to use

  1. Check allowed sources per directive and list extra hosts.
  2. Optionally add upgrade-insecure-requests / block-all-mixed-content.
  3. Copy the header or the <meta> tag.

What it supports

Emits selected directives, source keywords, and host entries — it concatenates, it does not audit. 'unsafe-inline'/'unsafe-eval' are flagged. frame-ancestors is dropped from the <meta> form because <meta> cannot carry it.

Related tools

Related guides