← All text tools

Content Security Policy generator

Build a Content-Security-Policy header by ticking sources, for HTML, Nginx and Apache.

  • Free
  • No sign-up
  • Works on any device

About Content Security Policy generator

Build a Content-Security-Policy by ticking which sources may load scripts, styles, images, fonts and frames, then copy it as an HTML meta tag or as Nginx or Apache header config. A strict policy limits damage from cross-site scripting, though blocking inline scripts may need nonces or hashes.

How to use Content Security Policy generator

  1. Tick the sources you allow for scripts, styles, images and other content types.
  2. Add your own domains where needed.
  3. Copy the header for HTML, Nginx or Apache.

Why use this tool?

Also known as

Frequently asked questions

Why does my CSP block inline scripts?

Without unsafe-inline, browsers refuse inline code. Move scripts to files, or allow specific ones with a nonce or hash instead of weakening the whole policy.

How can I test a CSP without breaking my site?

Start with the report-only version of the header. It logs violations in the browser console without blocking anything, so you can fix problems first.

What does the self keyword mean?

It allows resources from your own domain only. Anything from another domain must be listed explicitly.

Is Content Security Policy generator free?

Yes. Content Security Policy generator on Toolipedia is free to use, with no sign-up and no watermark.

Is it safe to use?

Yes. Everything is worked out in your browser, and nothing you enter is sent to our server.

Does it work on my phone?

Yes. It works in any modern browser on Android and iPhone, as well as on tablets and computers. There's nothing to install.

Do I need an account?

No. Just open the page and use the tool. There's no sign-up and no email needed.

Can I put Content Security Policy generator on my own website?

Yes. Use the Embed on your site button under the tool to copy a short piece of code and paste it into your page. It is free, needs no account, and the tool keeps working inside your page.

Related tools