Orveta

Content Security Policy (CSP) Header Generator

Developer

Build a valid CSP header by checking off allowed sources.

default-src (fallback for all types)

script-src (JavaScript)

style-src (CSS)

img-src (images)

font-src (web fonts)

connect-src (fetch/XHR/WebSocket)

frame-src (iframes)

media-src (audio/video)

object-src (plugins/embeds)

Generated header

Use as an HTTP response header or a meta tag.

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none';
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none';">

About this tool

Check off allowed script, style, image, and frame origins for each CSP directive, and instantly get a valid, correctly-formatted Content-Security-Policy header — plus real-time warnings when a setting like 'unsafe-inline' would weaken your XSS protection.

How to use Content Security Policy (CSP) Header Generator

  1. 1

    For each directive (script-src, style-src, img-src, etc.), select which source keywords to allow.

  2. 2

    Add any custom domains you need to allow, like a CDN or analytics provider.

  3. 3

    Review any warnings — 'unsafe-inline' and 'unsafe-eval' significantly weaken your protection.

  4. 4

    Copy the generated header value, or use the meta tag version if you can't set HTTP headers directly.

Frequently asked questions