What are the important limits?

Does not assess your site, validate every grammar rule, configure a report endpoint or generate runtime nonces. Report-only is not enforcement. A mistaken policy may break scripts, payment providers or embeds. frame-ancestors requires an HTTP header.

Where is my information stored?

Processing happens in your browser. These workspaces do not upload your inputs or send reports to a server. Session data is not automatically saved; download a project or report before closing. Keep sensitive exports private.

Content Security Policy Builder

Compose a CSP response header with directive controls, report-only mode and warnings for broad sources.

Local Developer Workbench

Content Security Policy · Build & Review

Files are processed in this browser. No requests are sent to your endpoints.

Report-only mode

default-srcscript-srcstyle-srcimg-srcfont-srcconnect-srcmedia-srcframe-srcobject-srcbase-uriform-actionframe-ancestors

Response Header

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'

Test in Report-Only before enforcing. This starter does not configure a reporting endpoint, validate source grammar exhaustively, generate per-request nonces or assess your site. CSP can block scripts, payments and embeds if configured incorrectly. frame-ancestors must be delivered as an HTTP header, not a meta tag.

Loading Tool…

What Is the Content Security Policy Builder?

Create a starter Content Security Policy using twelve common source directives. Self-hosted and Google Fonts presets make the effects of each source list visible. Report-only mode is enabled by default to support testing before enforcement.

How It Works

Choose a preset, edit allowed sources separated by spaces, and review the generated header. Use quoted CSP keywords such as self and none as shown in the fields. Copy the response header or download a TXT/PDF review copy. Test it against your actual application before configuring your server.

When to Use It

Use when inspecting local developer data or preparing configuration that needs review before production.

Frequently Asked Questions

How do I get started?: Choose a preset, edit allowed sources separated by spaces, and review the generated header. Use quoted CSP keywords such as self and none as shown in the fields. Copy the response header or download a TXT/PDF review copy. Test it against your actual application before configuring your server.
What are the important limits?: Does not assess your site, validate every grammar rule, configure a report endpoint or generate runtime nonces. Report-only is not enforcement. A mistaken policy may break scripts, payment providers or embeds. frame-ancestors requires an HTTP header.
Where is my information stored?: Processing happens in your browser. These workspaces do not upload your inputs or send reports to a server. Session data is not automatically saved; download a project or report before closing. Keep sensitive exports private.

Found an issue? Send Feedback. See our data sources and update policy for tools that depend on changing information.