CSP Header Generator
Build a Content-Security-Policy header value from common directives like script-src, style-src and img-src.
Your file is processed locally in your browser and is not uploaded to our server.
Content-Security-Policy
default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'
How to use CSP Header Generator
- 1Fill in a value for each directive you want to include (leave blank to omit it).
- 2The complete Content-Security-Policy header value is built automatically.
- 3Copy it into your server or CDN configuration.
Frequently asked questions
'self' allows content only from the same origin as the page. Other common sources include 'unsafe-inline', 'none', specific domains, or data: for inline data URIs.
Related tools
Developer
CORS Header Generator
Build Access-Control-* CORS response headers.
Developer
User-Agent Generator
Get an example User-Agent string for a browser/OS.
Developer
robots.txt Generator
Build a robots.txt file with allow/disallow rules and sitemap directives.
Developer
HTTP Header Tool
Parse raw HTTP headers, or build a header block.
Developer
Sitemap XML Generator
Generate a valid sitemap.xml file from a list of URLs.