A CSP generator and checker in one page
A Content-Security-Policy (CSP) tells the browser which scripts, styles, images, frames and connections a page may use, so that injected HTML cannot run an attacker’s JavaScript. This CSP generator builds the policy directive by directive — with one-click source buttons, a fresh 128-bit nonce, 'strict-dynamic' and an inline-script hash calculator — and exports it as an HTTP header, a <meta> tag, an Nginx or Apache line or a Netlify / Cloudflare Pages _headers entry.
It is also a CSP evaluator. Paste any existing policy and every directive is loaded into the editor and checked: 'unsafe-inline' without a nonce, wildcards and risky CDNs in script-src, missing object-src and base-uri, keywords written without quotes, typos such as scripts-src, duplicates and deprecated directives. Findings are graded from serious to informational, in plain English, as you edit.
How to use the CSP Generator
- Pick a preset: Strict, nonce-based for apps that render HTML on the server, Static site, Single-page app with an API or WordPress-like CMS — or paste your current policy into Or check an existing policy and press Analyse.
- Adjust each directive: type sources into its box or press the quick buttons such as
'self',data:or'nonce-…'. Pressing'none'replaces the list. - For inline scripts you cannot move, paste the code into Hash an inline script or style and press Add to script-src.
- Read the Policy check and fix red and amber items.
- Choose an output tab and press Copy. Tick Report-only mode to trial the policy without blocking anything.
CSP Generator features
Directive editor
Nineteen directives including fetch directives, base-uri, form-action, frame-ancestors, Trusted Types, report-to and upgrade-insecure-requests, plus a box for anything else (sandbox, script-src-attr…).
Nonces and hashes
Generates 128-bit Base64 nonces with crypto.getRandomValues and computes SHA-256, SHA-384 or SHA-512 source expressions with Web Crypto.
Built-in evaluator
Over twenty checks, each explaining why it matters — including when 'unsafe-inline' and host lists are safely ignored because 'strict-dynamic' is present.
Five deployment formats
HTTP header (with Reporting-Endpoints when you use report-to), meta tag with header-only directives removed, Nginx add_header … always, Apache Header always set and _headers.
Private
Policies, scripts and hashes are processed in your browser only.
Why nonces and strict-dynamic beat allow-lists
Older CSPs listed every trusted domain in script-src. Research on real deployments found that most such policies could be bypassed, because an allowed CDN or Google domain also hosted JSONP endpoints or old libraries an attacker could reuse. A strict CSP instead marks the scripts you wrote: each <script> carries a random nonce that matches the header, and 'strict-dynamic' lets those trusted scripts load their own dependencies. Injected markup has no valid nonce, so it cannot run.
The strict preset therefore reads script-src 'nonce-…' 'strict-dynamic' https: 'unsafe-inline'; object-src 'none'; base-uri 'none'. Modern browsers ignore https: and 'unsafe-inline' in this policy; they are there only so that very old browsers keep working rather than breaking.
Worked example: hashing an inline script
If a page contains <script>alert('Hello, world.');</script>, hash exactly the text between the tags. SHA-256 of alert('Hello, world.'); is 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=' — the example used in the CSP Level 3 specification and the value this tool shows. Add one space or a line break and the hash changes, so generate hashes from the final, minified HTML. For other hash formats, the Hash Generator shows hex and Base64 digests.
Directives that do not fall back to default-src
Roll out in stages: send the policy as Content-Security-Policy-Report-Only with a report endpoint, fix what it reports, then switch to enforcing. Pair it with hardened cookies from the Cookie Generator, and if you manage Apache rules, the .htaccess Redirect Generator covers redirects.
| Directive | Recommended value | Why |
|---|---|---|
| base-uri | 'none' or 'self' | Stops an injected <base> from redirecting relative URLs |
| form-action | 'self' | Stops injected forms posting data to another site |
| frame-ancestors | 'none' or 'self' | Clickjacking protection; header only, ignored in meta tags |
| object-src | 'none' | Falls back to default-src, but should almost always be none |
| upgrade-insecure-requests | (no value) | Rewrites http:// sub-resources to https:// |
CSP Generator FAQ
What is a good Content-Security-Policy to start with?
For server-rendered apps, the strict nonce-based preset: script-src 'nonce-RANDOM' 'strict-dynamic'; object-src 'none'; base-uri 'none' plus fallbacks. For static sites that cannot change a nonce per response, use default-src 'self' and hashes for any inline scripts.
How do I check whether my CSP is secure?
Paste it into the CSP generator’s “check an existing policy” box and press Analyse. The evaluator lists serious problems such as 'unsafe-inline' without a nonce or a wildcard in script-src first, then improvements and notes.
Should I use a meta tag or an HTTP header?
The HTTP header is better: it supports frame-ancestors, sandbox, report-only mode and reporting, and it applies before any HTML is parsed. Use the meta tag only on hosts where you cannot set headers.
Why does my site break after adding a CSP?
Usually because of inline scripts, inline event handlers (onclick=…) or third-party scripts that are not allowed. Deploy in report-only mode first, read the violation reports or browser console, and add nonces, hashes or the specific sources needed.
Can I reuse the same nonce?
No. A nonce must be unpredictable and different for every response. A nonce written into a static file or cached page can be copied by an attacker, which makes it worthless — use hashes for static content instead.
Is unsafe-inline ever acceptable?
In script-src only as an ignored fallback next to a nonce or hash. In style-src it is common and lower risk, though CSS injection can still leak data from a page.