Build a Content-Security-Policy header with per-directive guidance. Hardens against XSS by default.
default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
The policy is generated locally from your selections. Nothing is uploaded.
A Content-Security-Policy is a whitelist the browser enforces: scripts, styles, images, and connections may only come from origins you allow. Its headline win is XSS mitigation — even if an attacker injects a <script> tag, the browser refuses to run it unless script-src permits its origin. Use 'none' for things you truly do not need (object-src, frame-ancestors), avoid unsafe-inline in script-src if at all possible, and ship the header with report-only mode first (Content-Security-Policy-Report-Only) to catch breakage before enforcing.
The policy is metadata about your page: the browser refuses any resource outside the allow-list.
Priya ships a static marketing site with self-hosted fonts and one Google Analytics tag, and wants a tight policy.
Generate a Content-Security-Policy header online free: 12 guided directives with safe defaults and live preview. Everything runs locally; nothing is uploaded.
FreeToolHub CSP Generator is a free browser-based tool — generate a Content-Security-Policy header online free: 12 guided directives with safe defaults and live preview. No signup, no upload; everything runs locally in your browser.
Generate a Content-Security-Policy header online free: 12 guided directives with safe defaults and live preview.
Input validation and output encoding reduce the chance of injection, but a Content-Security-Policy limits the blast radius when something slips through: a browser that refuses to run scripts from unapproved origins cannot execute an injected payload. CSP is the last line of defense, and it costs one header.
The generator exposes 12 directives - default-src, script-src, style-src, img-src, font-src, connect-src, media-src, object-src, frame-src, frame-ancestors, base-uri, and form-action - each with a one-line explanation of what it gates. Safe defaults pre-load the form so the common case (self everywhere, nothing exotic) is one click, and every edit updates the policy live.
The safe path to a strict policy is gradual. Start in Report-Only mode by serving the header with the report-to directive and no enforcement — violations are logged while the site behaves normally, and the reports name every script, style, and endpoint the policy would block. Fix the report noise: move inline handlers into files, add nonces or hashes for the scripts you genuinely need, and pin down the third-party origins you actually load. When reports run quiet for a couple of weeks, flip the header from Content-Security-Policy-Report-Only to Content-Security-Policy and keep the reporting endpoint live — a sudden spike after a new third-party tag ships is your early-warning system. This generator produces both variants of the header so the rollout never requires hand-editing the policy.
It is an HTTP header that tells browsers exactly which sources of scripts, styles, images, and connections your page may load. Anything not allow-listed is blocked, which is the single most effective defense against cross-site scripting (XSS) attacks.
The generator starts from a conservative baseline: default-src set to self, scripts and styles limited to self plus unsafe-inline only where frameworks genuinely need it, and object-src set to none. Each of the 12 directives ships with a plain-English explanation so you know what you are allowing before you allow it.
Deploy it first as Content-Security-Policy-Report-Only instead of the enforcing header. Browsers report violations to the console without blocking anything; once the reports are quiet, switch to the enforcing header.
The enforcement cost is negligible — the browser checks origins as it loads resources, adding microseconds per request. If anything, a strict policy improves load performance because it blocks untrusted third-party scripts before they download. The one real cost is engineering time during rollout, not runtime.
report-uri is the older directive that POSTs violation JSON to a single endpoint; report-to is its successor, built on the Reporting API with named endpoint groups, delivery routing, and better browser support going forward. This generator emits both pointing at the same collector, so older and newer browsers both report.
What do you call a nosy pepper?
No signups, no data sold. Every tool is free to use — the free tier allows 5 downloads or saves per day, and the optional Pro plan ($7/mo, $59/yr) adds unlimited downloads, batch processing, white-label exports and an ad-free experience.
☕Support me on Ko-fi— support the free tier100% of proceeds go towards hosting & building more free tools.