Directives
Add one or more allowed sources per directive. Leave a directive empty to omit it from the policy entirely.
Delivery Options
Generated Policy
XSS Protection • Security Warnings Built In • HTTP Header or Meta Tag
Add one or more allowed sources per directive. Leave a directive empty to omit it from the policy entirely.
A Content Security Policy is a browser-enforced allowlist that restricts where a page is allowed to load scripts, styles, images, and other resources from — it's one of the most effective defenses against Cross-Site Scripting (XSS), because even if an attacker manages to inject a <script> tag into your page, the browser will refuse to execute it unless it comes from an origin your policy explicitly permits.
Keyword values like 'self', 'none', and 'unsafe-inline' are wrapped in single quotes in the policy syntax, while actual URLs and schemes like https://cdn.example.com or data: are written bare, without quotes — mixing these up is a common source of a policy that silently doesn't work. This tool also flags 'unsafe-inline' and 'unsafe-eval' when you add them to script-src, since these two values significantly weaken CSP's XSS protection and defeat much of the point of using it in the first place — they're sometimes necessary for compatibility with older code, but it's worth knowing the tradeoff.
You can deliver a CSP either as an HTTP response header (the more capable and recommended option) or as an HTML <meta> tag when you don't control server headers — but a few directives, including frame-ancestors, report-uri, report-to, and sandbox, are only honored via the HTTP header and are silently ignored inside a <meta> tag per the CSP specification; this tool warns you if your policy includes one of those while Meta Tag mode is selected. Report-Only mode sends violation reports without actually blocking anything, which is the safe way to test a new policy against real traffic before enforcing it.