⌘K

CSP Generator

Generate Content Security Policy headers.

Runs in your browser — your data never leaves your device

Generated CSP Header

default-src 'self'; script-src 'self' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; media-src 'self'; worker-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'

About Content Security Policy (CSP)

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.

How it Works

You configure a CSP by specifying which domains the browser should consider to be valid sources of executable scripts. A CSP compatible browser will then only execute scripts loaded in source files received from those allowed domains, ignoring all other scripts.

Build a Content Security Policy header to protect your website from cross-site scripting and data injection attacks. Configure which domains can serve scripts, styles, images, and other resources through an interactive directive editor.

Why CSP Matters

Content Security Policy is one of the most effective defenses against cross-site scripting (XSS) attacks. By specifying exactly which domains and sources are trusted to serve scripts, styles, and other resources, CSP prevents browsers from loading malicious code injected through compromised third-party scripts, XSS vulnerabilities, or man-in-the-middle attacks. Implementing a strict CSP significantly reduces your attack surface.

Configuring Directives

The default-src directive serves as a fallback for all fetch directives not explicitly defined. script-src controls which scripts the browser can execute, while style-src governs stylesheets. The tool lets you toggle standard sources like self and unsafe-inline, and add custom domain origins for each directive. Start with a permissive policy and tighten it incrementally to avoid breaking existing functionality.

Frequently Asked Questions

What is a CSP generator?

A CSP generator helps you create Content Security Policy headers that restrict which resources (scripts, styles, images, fonts) can be loaded by your website, preventing XSS and data injection attacks.

How do I use the CSP generator?

Configure your policy directives through the interactive UI — select allowed sources for scripts, styles, images, and other resources. The tool generates the complete CSP header value.

What does Content Security Policy protect against?

CSP prevents Cross-Site Scripting (XSS), clickjacking, and data injection attacks by telling the browser exactly which sources are trusted for loading resources.

Can I use this for reporting only?

Yes, CSP supports report-only mode where violations are logged but not blocked, allowing you to test your policy before enforcing it in production.

Is this tool free?

Yes, ToolDock's CSP generator is completely free, requires no signup, and runs entirely in your browser.

Security Headers Checker

Analyze HTTP response headers for security.

SRI Hash Generator

Generate Subresource Integrity hashes for scripts and stylesheets.

TLS/SSL Certificate Checker

Check a domain's SSL/TLS certificate details.

default-src

Fetch Directives

Document Directives

Navigation Directives

About Content Security Policy (CSP)

How it Works

Why CSP Matters

Configuring Directives

Frequently Asked Questions

What is a CSP generator?

How do I use the CSP generator?

What does Content Security Policy protect against?

Can I use this for reporting only?

Is this tool free?

Related Tools

default-src

Fetch Directives

Document Directives

Navigation Directives

About Content Security Policy (CSP)

How it Works

Why CSP Matters

Configuring Directives