Skip to content
ToolQivo

CSP Generator

Build a Content-Security-Policy header directive by directive.

Developer Tools Reviews Free · no sign-up

Quick Tool Overview

The CSP Generator builds a Content-Security-Policy directive by directive, explaining each one and flagging the values that quietly undo the protection — unsafe-inline above all.

What it does
Builds and reviews a Content-Security-Policy header
You give it
The sources each resource type needs
You get back
A policy header, with its weaknesses named
Best for
Hardening a site against cross-site scripting
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the CSP Generator

Content-Security-Policy is the strongest defence against cross-site scripting and the easiest header to get wrong. This builds one directive at a time, explaining what each controls and warning where a value undoes the protection you are adding.

The warnings matter more than the builder. unsafe-inline in script-src defeats essentially the whole policy. unsafe-eval reopens a class of injection. A wildcard source allows any host on the internet. Missing object-src and base-uri leave two well-known bypasses open. The generator flags all of those, offers a nonce-based approach as the alternative to unsafe-inline, and can emit the header in report-only mode so you can watch what a policy would block before enforcing it.

Key features of the CSP Generator

Warns where it matters

unsafe-inline in script-src removes almost all the protection CSP offers, and the generator says so rather than quietly including it.

Covers the known bypasses

object-src 'none' and base-uri 'self' are both prompted for, because leaving them out leaves two documented holes open.

Nonce approach offered

The practical alternative to unsafe-inline, with the server-side pattern explained rather than just named.

Report-only mode

Emit the header in the form that reports violations without blocking, which is the only sane way to roll out a first policy.

Presets to start from

A strict baseline and a typical-site policy, so you are adjusting something sensible rather than starting from nothing.

How to use the CSP Generator

  1. 1

    Start with a preset

    A strict baseline, a typical site, or an empty policy to build from scratch.

  2. 2

    Set each directive

    Add the sources each resource type needs, with the keyword values explained.

  3. 3

    Read the warnings

    Values that weaken the policy are flagged with what they let through.

  4. 4

    Deploy report-only first

    Collect violation reports before enforcing, so you find what breaks without breaking it.

Frequently asked questions

Because the main thing CSP prevents is injected script running, and unsafe-inline permits exactly that. A policy with unsafe-inline in script-src provides almost no XSS protection at all.

Reviews of the CSP Generator

What people who use the CSP Generator think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the CSP Generator. It takes half a minute and no account.

Write the first review

More developer tools