Content Security Policy (CSP) Header Generator

CSP DIRECTIVES CONFIGURATION

Security Preset Level

Allowed Script Sources (script-src)

Allowed Style Sources (style-src)

GENERATED CSP HEADER DIRECTIVE

HTTP Header Output

Nginx Config Directive

Content Security Policy (CSP) Implementation Guide

Content Security Policy is an essential defense-in-depth HTTP header that guards against Cross-Site Scripting (XSS), data injection, and iframe clickjacking attacks.

Recommended CSP Directives

default-src 'self' — Restricts default fallback resources to same origin.
script-src — Specifies trusted JavaScript sources.
style-src — Controls stylesheet and font loading.
frame-ancestors 'none' — Prevents iframe embedding and clickjacking.
upgrade-insecure-requests — Instructs browsers to automatically upgrade HTTP requests to HTTPS.

Related Security Tools

Generate HSTS headers with our HSTS Header Generator, block clickjacking with the X-Frame-Options Generator, or test JWTs using the JWT Inspector.

Frequently Asked Questions

Common questions about this tool.

What is a Content Security Policy (CSP) header? ▼

A Content Security Policy (`Content-Security-Policy`) HTTP header restricts the sources from which scripts, styles, images, and frames can be loaded, shielding web apps from Cross-Site Scripting (XSS).

What does `default-src 'self'` mean in CSP? ▼

`default-src 'self'` serves as a fallback directive that restricts all un-specified resource types (scripts, fonts, images) to load only from the exact same origin domain.

How do nonces and hashes work in script-src directives? ▼

Nonces (`'nonce-rAnd0m'`) and SHA-256 hashes (`'sha256-...'`) allow specific inline scripts to execute while blocking unauthorized injected scripts.

What is the difference between Content-Security-Policy and Report-Only? ▼

`Content-Security-Policy-Report-Only` monitors and logs policy violations to a reporting endpoint without blocking resource loads, allowing safe staging testing.

How do I deploy CSP headers in Nginx or Cloudflare? ▼

Copy the generated `add_header Content-Security-Policy "..."` directive and paste it into your server block or Cloudflare Transform Rules.