Content Security Policy Generator creates a practical baseline CSP header for static sites and simple web apps. It helps reduce unsafe defaults while keeping the policy readable.
Build a starter CSP header for static sites and simple apps. Everything runs locally in this tab.
Content-Security-Policy: default-src 'self'; script-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';
Yes. The tool is free and runs directly in your browser with no account required.
No. The header string is assembled locally in the browser tab and is not sent to a server.
Producing a readable starting-point CSP header for a static site or simple web app, rather than writing every directive from scratch.
You set default-src, img-src, and script-src directly. The tool fills in reasonable fixed values for style-src, object-src, base-uri, and frame-ancestors so the policy is complete.
Allowing inline styles keeps the starter policy from breaking common inline style attributes. For a stricter policy, remove 'unsafe-inline' once you've moved styles to external stylesheets or added nonces.
Yes. Any CSP can block scripts, images, or fonts your site actually needs. Deploy it first as a Content-Security-Policy-Report-Only header, or test in a staging environment, before enforcing it in production.
Add it as an HTTP response header from your web server or CDN config (Apache, Nginx, Cloudflare, etc.) — this tool only generates the header value, it does not apply it to a live site.
No — it's a practical baseline covering the most commonly needed directives. Advanced use cases (nonces, hashes, report-uri, worker-src, etc.) need to be added manually to the generated string.
