Content Security Policy Builder

Configure CSP directives visually, preview the generated header, and copy it in your preferred format.

Report-Only mode

Directives

Toggle directives and click source pills to include them

default-src

Fallback for fetch directives not explicitly set. Acts as the catch-all for all resource types.

script-src

Controls which scripts can be executed. Restricting this is one of the most important CSP directives.

style-src

Defines valid sources for stylesheets. Use 'unsafe-inline' cautiously — prefer nonces or hashes.

img-src

Specifies valid sources for images and favicons, including data: URIs.

connect-src

Restricts URLs that can be loaded using fetch, XMLHttpRequest, WebSocket, and EventSource.

'self''none''unsafe-inline''unsafe-eval'data:https:*

font-src

Specifies valid sources for loading fonts via @font-face.

'self''none''unsafe-inline''unsafe-eval'data:https:*

object-src

Restricts sources for <object>, <embed>, and <applet> elements. Recommend 'none'.

media-src

Defines valid sources for loading audio and video, e.g., <audio> and <video>.

'self''none''unsafe-inline''unsafe-eval'data:https:*

frame-src

Specifies valid sources for nested browsing contexts, i.e., <frame> and <iframe>.

'self''none''unsafe-inline''unsafe-eval'data:https:*

worker-src

Restricts URLs which may be loaded as a Worker, SharedWorker, or ServiceWorker.

'self''none''unsafe-inline''unsafe-eval'data:https:*

form-action

Restricts the URLs which can be used as the target of form submissions.

'self''none''unsafe-inline''unsafe-eval'data:https:*

frame-ancestors

Specifies valid parents that may embed this page via <frame>, <iframe>, etc. Replaces X-Frame-Options.

'self''none''unsafe-inline''unsafe-eval'data:https:*

base-uri

Restricts the URLs which can be used in a <base> element to alter the base URL.

'self''none''unsafe-inline''unsafe-eval'data:https:*

upgrade-insecure-requests

Instructs browsers to treat all HTTP URLs as HTTPS. No source list needed.

No source list — directive only

block-all-mixed-content

Blocks all mixed content (HTTP on HTTPS). Superseded by upgrade-insecure-requests in modern browsers.

No source list — directive only

Content-Security-Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'