CSP Security Header Builder
Pick sources for each directive below. Your Content-Security-Policy is generated live, with server snippets for Apache and Nginx.
Strict: only your own domain, no frames, no plugins — strongest protection.
HTTP header
Meta tag version
Apache (.htaccess)
Nginx snippet
'self'— only your own domain (same scheme and host).'none'— blocks everything for that directive.https:— any source over HTTPS.data:/blob:— inline data URLs, useful for images.'unsafe-inline'— allows inline scripts and styles; weakens XSS protection.'unsafe-eval'— allowseval()and similar; avoid unless a library truly needs it.
Frequently Asked Questions (FAQ)
What is a Content Security Policy?
It is an HTTP header that tells the browser exactly which sources may load scripts, styles, images, fonts, and frames on your page, which blocks most cross-site scripting (XSS) attacks.
Why does this tool warn about unsafe-inline?
The unsafe-inline source lets any inline script or style run, which removes most of the XSS protection CSP gives you. It is better to use nonces or hashes for the inline code you trust.
What is the difference between the Strict, Balanced, and Permissive presets?
Strict allows only your own domain and blocks frames and plugins; Balanced keeps your own domain plus HTTPS CDNs and inline styles for typical sites; Permissive is a starting policy for sites with many third-party embeds, which you should tighten over time.
Can I use the meta tag version instead of the HTTP header?
Mostly yes, but the frame-ancestors and report directives are ignored in meta tags, so use the real HTTP header on your server for full protection.
Is my policy configuration uploaded anywhere?
No. The policy is generated entirely in your browser; nothing is sent to any server.