ZenovayTools

CSP Header Generator

Generate Content-Security-Policy headers with a visual editor. Pick directives, use presets, and copy the result.

Generated Policy

HTTP Header
Content-Security-Policy: default-src 'self'
HTML Meta Tag
<meta http-equiv="Content-Security-Policy" content="default-src 'self'">

How to Use CSP Header Generator

  1. 1Start with a preset (strict, moderate, or permissive) or build from scratch.
  2. 2Configure individual directives like script-src, style-src, and img-src.
  3. 3Add allowed sources (self, specific domains, inline, eval) for each directive.
  4. 4Preview the generated CSP header string.
  5. 5Copy the result as an HTTP header or HTML meta tag.
Zenovay

Track your website performance

Real-time analytics, session replay, heatmaps, and AI insights. 2-minute setup, privacy-first.

Try Zenovay Analytics — Free

Related Tools

Password GeneratorGenerate strong, random passwords with customizable length, characters, and complexity.
Password Strength CheckerCheck how strong your password is. Get an estimated crack time and improvement suggestions.
HMAC GeneratorGenerate HMAC signatures using SHA-256, SHA-384, or SHA-512 with the Web Crypto API.
AES Encryption/DecryptionEncrypt and decrypt text using AES-GCM with PBKDF2 key derivation. Runs entirely in your browser.

Frequently Asked Questions

What is Content-Security-Policy (CSP)?▾
CSP is an HTTP header that controls which resources a browser can load for a page. It helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks.
What does each directive do?▾
default-src is the fallback for all resource types. script-src controls JavaScript, style-src controls CSS, img-src controls images, connect-src controls fetch/XHR, font-src controls fonts, frame-src controls iframes, and form-action controls form submissions.
Should I use a CSP meta tag or HTTP header?▾
An HTTP header is preferred as it covers all content types. A meta tag works for basic policies but has limitations: it can't use frame-ancestors or report-uri directives.
What are common CSP values?▾
'self' allows same-origin only. 'none' blocks all. 'unsafe-inline' allows inline scripts/styles (not recommended). Specific domains like https://cdn.example.com whitelist that origin.
Is my CSP configuration processed locally?▾
Yes, the CSP header is built entirely in your browser. No configuration data is sent to any server.
Can I copy the generated CSP header?▾
Yes. The generated header string can be copied with one click for pasting into your web server configuration, .htaccess file, or application middleware.
How do I test my CSP policy?▾
After deploying the CSP header, open your browser's developer tools and check the console for CSP violation reports. You can also use report-uri or report-to directives to collect violations in production.