CSP builder and checker

Understand a Content-Security-Policy header, or build one that fits your site.

Processed on your device, never uploaded

Policy

Content-Security-Policy

Paste the header value, the whole header line, a meta tag, or an nginx or Apache line

Explained

Each directive is explained here, with warnings for the risky parts.

What it does

A Content-Security-Policy tells the browser which scripts, styles, images and frames a page may load, which blocks inline and outside scripts unless you allow them. This tool explains each directive in plain words, warns about risky choices such as unsafe-inline, unsafe-eval and wildcards, and lists missing protections. You can also build a policy from simple choices and copy it as an HTTP header, a meta tag, an nginx line or an Apache line.

How to use it

1Paste your policy, or switch to Build.
2Read the explanation and fix the warnings.
3Copy the result as a header, meta tag, nginx or Apache line.

Questions

Is my policy sent anywhere?

No. It is read and checked in your browser.

Why is unsafe-inline a problem?

It lets any script that gets injected into the page run. A nonce or hash allows only the scripts you meant.

Will a new policy break my site?

It can. Try it as Content-Security-Policy-Report-Only first, watch the reports, then switch it on.