CSP
Security utility
Content Security Policy Builder
Build a practical CSP header and spot common policy risks. Private by default, with all processing done in your browser.
Policy sources
Keep sources as narrow as possible. This produces a header value, not a guarantee that an app is configured safely.
Quick checks
✓ No common policy warnings.
Result
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none';Ready — processing stays in your browser.
How to use this tool
A quick content security policy builder workflow
Build a practical CSP header and spot common policy risks. Paste or enter your data, use the available controls, then copy or download the result when it is ready.
- Everything runs in your browser, so your working data stays on your device.
- No account, installation, or upload is needed.
- Use the related utilities below when you need the next step in your workflow.