CSP Builder
NEWBuild a Content Security Policy header interactively
Build a Content Security Policy header interactively. Toggle allowed sources for each directive.
default-src
Fallback for all resource types not explicitly configured
script-src
Allowed JavaScript sources
style-src
Allowed CSS sources
img-src
Allowed image sources
font-src
Allowed font sources
connect-src
Allowed URLs for fetch/XHR/WebSocket
frame-src
Allowed frame/iframe sources
media-src
Allowed audio/video sources
object-src
Allowed plugin sources (Flash, etc.)
base-uri
Restricts <base> element URLs
form-action
Restricts form submission targets
frame-ancestors
Controls who can embed this page in a frame
upgrade-insecure-requests
Upgrade HTTP to HTTPS automatically
block-all-mixed-content
Block all mixed HTTP/HTTPS content
Generated CSP Header
HTTP Header:
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests
Meta tag:
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests">