Content Security Policy Header Builder

Build a copy-ready CSP header, preview common risk warnings, and switch between enforce and report-only mode.

Preset

Header mode

Report URI

default-src

script-src

style-src

img-src

connect-src

font-src

frame-ancestors

Source format

Use values like 'self', https://cdn.example.com, data:, or 'none'. Commas and semicolons are cleaned automatically.

object-src 'none' base-uri 'self' form-action 'self' upgrade-insecure-requests

Mode

Enforce

Directives

Warnings

Header Name

Content-Security-Policy

Interpretation

Build a policy to review the directive mix.

Header output

Server examples

Warnings

Ready.