CSP header generator — build a Content-Security-Policy

How to use the CSP header generator

1. Go through the directive fields, from default-src to frame-ancestors. Separate sources with spaces, for example 'self' https://cdn.example.com. Leave a field blank to omit that directive.
2. Keep upgrade-insecure-requests ticked to load http:// resources over https.
3. Optionally enter a report-uri that collects violation reports.
4. Tick Report-only (test without blocking) for a first rollout.
5. Pick Output as: HTTP header, nginx, Apache or <meta> tag, then copy the policy and read any warnings below it.

What it does and when to use it

A Content-Security-Policy tells the browser which origins may supply scripts, styles, images, fonts, frames and network requests for your page. If an attacker manages to inject a script tag, a strict policy stops it from running. It also controls who may embed your site in a frame.

The defaults suit a typical site with Google Tag Manager and Google Analytics. Replace those hosts with your own. Put the nginx line inside a server block from the nginx config generator, or the Apache line into a file from the .htaccess generator. The HTTP headers reference explains the other security headers that usually travel with CSP.

How it works

Each field becomes one directive; blank fields are dropped, and duplicate sources are removed. The tool then checks for risky combinations:

• 'none' mixed with other sources (browsers ignore the others);
• 'unsafe-inline' in script-src without a nonce or hash;
• 'unsafe-eval' in script-src;
• * in script-src or default-src.

The directives are joined with ; and wrapped for the chosen server. The directive names follow MDN’s Content-Security-Policy reference.

Worked examples

Default policy as a header (shortened):

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com; … frame-ancestors 'none'; upgrade-insecure-requests

Typing keywords without quotes, for nginx. script-src self unsafe-inline becomes script-src 'self' 'unsafe-inline' inside add_header Content-Security-Policy "…" always;. A warning says unsafe-inline “removes most of the XSS protection CSP provides”.

Meta tag with report-only ticked. No tag is written. The tool explains that a meta tag cannot be report-only, because browsers would enforce it, and asks you to choose a header format or untick Report-only.

Apache, report-only. The line starts Header always set Content-Security-Policy-Report-Only "default-src 'self'; …".

Limits and tips

• The tool does not scan your pages. You must list every third-party host yourself.
• Nonces must be new on every response, so they belong in server code, not in a fixed header.
• report-uri is deprecated in favour of report-to, which needs a separate Reporting-Endpoints header the tool does not write.
• Test in report-only mode for a few days, then enforce.