BYTETOOLS

CSP Header Generator

Build a Content-Security-Policy header directive by directive, with quick-add source tokens, nonce support and warnings for unsafe combinations.

HTTP response header

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

<meta> equivalent

<meta http-equiv="Content-Security-Policy" content="default-src &#39;self&#39;; object-src &#39;none&#39;; base-uri &#39;self&#39;">

frame-ancestors and report-uri are ignored inside a <meta> tag, so 1 directive was left out. Send those as a real header.

What is the CSP Header Generator?

A Content-Security-Policy is an HTTP header that tells the browser which sources of scripts, styles, images and other resources your page is allowed to load, which shuts down most cross-site scripting attacks.

  • Fourteen commonly used CSP directives with inline explanations
  • Quick-add buttons for 'self', 'none', https:, data: and other tokens
  • Random nonce generation for script-src and style-src
  • Warnings for unsafe-inline, unsafe-eval, wildcards and missing directives
  • Report-Only mode and report-uri support
  • Both the HTTP header and the <meta http-equiv> form, with meta caveats explained

How to use the CSP Header Generator

  1. 1

    Set default-src first — it is the fallback for everything you do not name explicitly.

  2. 2

    Fill in script-src, style-src and the other directives, using the quick-add buttons for tokens like 'self'.

  3. 3

    Turn on the nonce option if you must allow specific inline scripts.

  4. 4

    Read the warnings panel and remove anything it flags as unsafe.

  5. 5

    Copy the header, or the meta tag version, and deploy it in Report-Only mode first.

About the CSP Header Generator

The ByteTools CSP Header Generator helps you write a Content-Security-Policy without memorising the syntax. Fill in the directives you care about, click the quick-add buttons for common source tokens, and the finished header appears below along with the equivalent meta tag.

It covers the directives that actually matter in production — default-src, script-src, style-src, connect-src, frame-ancestors, base-uri, form-action and the rest — and flags the combinations that quietly defeat the whole policy, such as 'unsafe-inline' in script-src or a bare wildcard.

Nothing is sent anywhere; the policy string is assembled in your browser as you type, so you can paste in the hostnames of an unreleased project without exposing them. Start in Report-Only mode on a real page, watch what breaks in the browser console, then tighten the directives one at a time and switch to enforcing.

Frequently asked questions

What does Content-Security-Policy actually protect against?

Mainly cross-site scripting. Even if an attacker injects a script tag into your page, the browser refuses to run it unless it comes from a source your policy allows. It also limits clickjacking, form hijacking and mixed content.

Should I use the header or a meta tag?

The HTTP header, whenever you can. A meta tag works for most fetch directives, but frame-ancestors, report-uri and sandbox are ignored inside meta, and the policy only applies from the point the tag is parsed onwards.

Why is 'unsafe-inline' a problem in script-src?

Because it re-allows exactly what CSP exists to block: script that appears inline in the page. An attacker who can inject HTML can then inject a working script tag. Use a per-request nonce or hashes for the inline scripts you genuinely need.

What is a CSP nonce and how do I use it?

A nonce is a random value your server generates fresh for every response, puts in the policy as 'nonce-abc123' and repeats as a nonce attribute on each allowed script tag. It only works if it is unpredictable and never reused, so a hard-coded nonce is worthless.

How do I roll out a CSP without breaking my site?

Deploy it as Content-Security-Policy-Report-Only with a report-uri first. The browser reports violations but blocks nothing, so you can see every resource your policy would have stopped, fix the list over a few days, then switch to the enforcing header.

Related tools