Tick the sources you need to allow — scripts, styles, images, fonts, connections — and the tool builds a Content-Security-Policy header value with the matching directives.
Set it as an HTTP response header (Content-Security-Policy) from your server or reverse proxy config — pasting it into HTML alone will not enforce it.
Yes, as a starting point — double-check paths, URLs, and directives against your actual domain before deploying.
No. Everything is built client-side in your browser from the values you enter.