◎ SEOlust
Security

CSP Header Generator

Build a Content-Security-Policy header visually. Pick directives and sources, then copy the header or meta tag. Reduce XSS risk.

All tools

About the CSP Header Generator

Build a Content-Security-Policy visually by choosing directives and allowed sources, then copy it as an HTTP header, a meta tag, or an .htaccess rule.

What this tool does

Content-Security-Policy (CSP) is a browser security feature that controls which scripts, styles, images, and other resources a page may load. This generator lets you toggle common sources for each directive and produces a ready-to-deploy policy in three formats.

Why CSP matters

A well-configured CSP is one of the strongest defenses against cross-site scripting (XSS) and data injection:

  • Blocks injected or malicious inline scripts from executing.
  • Restricts resource loading to domains you trust.
  • Helps prevent clickjacking via frame-ancestors.
  • Is increasingly expected in security audits and pen tests.

Deployment tips

Roll out CSP carefully to avoid breaking your site:

  • Start with Content-Security-Policy-Report-Only to log violations without enforcing.
  • Avoid 'unsafe-inline' for scripts where possible — prefer nonces or hashes.
  • 'none' on a directive overrides all other sources for it.
  • Test thoroughly; a strict policy can block legitimate assets.

FAQ

Where do I put the generated policy?
Send it as an HTTP response header (best), or use the meta tag for static hosting. The .htaccess snippet sets the header on Apache.
What is the difference between the header and meta versions?
They are largely equivalent, but some directives (like frame-ancestors and report-uri) only work via the HTTP header, not the meta tag.
Why is 'unsafe-inline' discouraged?
It allows any inline script or style to run, which defeats much of CSP's XSS protection. Use nonces or hashes for inline code instead.
Will this break my site?
It can if a required source is missing. Test with report-only mode first and watch the browser console for blocked resources.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.