CSP Policy Builder
Build a conservative Content-Security-Policy response header using exact HTTPS source origins.
Loading tool…
How to use CSP Policy Builder
Draft an allowlist-based CSP header for a local-processing web application. Inline code, objects, frames, form submission, and embedding are blocked; additional source origins must be explicitly entered.
- List only trusted exact HTTPS origins and choose whether application connections are allowed.
- Select Run tool to build a restrictive CSP response-header draft.
- Review the result, then copy it or download the generated file.
Good to know
- Header draft only: it is not installed, tested, a nonce/hash-based strict CSP, or a guarantee against XSS. Self-hosted scripts remain trusted.
- Origins cannot contain paths, wildcards, credentials, unsafe-inline, or injected directives. frame-ancestors requires an HTTP response header and does not work in a meta tag.
Common questions
Can I paste this into a meta element?
Some directives work there, but frame-ancestors does not. Configure and verify the actual HTTP response header, then test every required resource and workflow.
Keep going with related tools
All developer →SRI Hash Generator
Generate a Subresource Integrity SHA-2 token for exact pasted UTF-8 JavaScript or CSS contents.
DeveloperRobots.txt Generator
Build one crawler-rule group and optional sitemap lines with validated paths and URLs.
DeveloperInline CSP Hash Source Builder
Extract selected inline HTML script and style text, then export exact UTF-8 hash sources with parsed-content evidence.
DeveloperPermissions Policy Workbench
Build or inspect supported Permissions-Policy headers and iframe allow grammar.