CSP Generator
Generate Content Security Policy headers. Build CSP rules with our visual editor.
Start with a Preset
Configure Directives
Additional Options
Security Warnings
- •'unsafe-inline' in script-src significantly reduces XSS protection
- •'unsafe-inline' in style-src allows inline styles
- •Consider adding frame-ancestors to prevent clickjacking
Generated CSP
default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; object-src 'none'; upgrade-insecure-requests