How to use the content security policy builder
- Fill in the sources for the directives you want, separated by spaces. The first four boxes are shown, and the rest are under advanced options.
- Write keywords without quotes, such as self or none. The page adds the quotes. Hosts and schemes are written as they are, such as https://cdn.example.com or data:.
- Optionally tick upgrade-insecure-requests or block-all-mixed-content.
- Copy the header, or take the meta tag from the steps list, and read any warnings there.
Formula
directive = name + space + sources, and directives are joined by "; "
quoted: self, none, unsafe-inline, unsafe-eval, strict-dynamic, report-sample, and nonce- and hash sources
not quoted: hosts, schemes, and *
a directive using none has no other source
Repeated sources are removed. Semicolons, commas, quotes and angle brackets are not allowed inside a source. A meta tag cannot carry frame-ancestors, so it is left out of that version.
A same-origin policy
With default-src self, object-src none, base-uri self, form-action self and frame-ancestors none, the header is default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'. The meta tag has the same directives without frame-ancestors.
To allow one script host, add script-src with self and https://cdn.example.com. The header then includes script-src 'self' https://cdn.example.com. Typing unsafe-inline in a script box adds a warning, because it lets injected inline code run.
What a policy does
A Content Security Policy tells the browser which places a page may load scripts, styles, images and other resources from. If a page is tricked into including a script from another place, the browser can refuse to run it. The default-src directive is the fallback for other directives you do not list.
Test before you rely on it
A policy that is too strict can break your pages, and one that is too loose protects less. Try it first in report-only mode on a copy of the site, and watch the browser console for blocked items. This page builds the text and flags a few risky settings, but it cannot test the policy against your site. See also the HTTP Status Codes reference and the JWT Decoder for other web debugging.
Assumptions and limits
- The page does not check that the sources exist or that the policy works with your site.
- Only common directives are listed. Add others by hand if you need them.
- The meta tag version is limited by what browsers allow in a meta tag.
- Your entries stay in your browser and are not part of share links.
Frequently asked questions
Should I write quotes around self?
No. Type self and the page adds the quotes. If you do type them, they are accepted and not doubled.
Why is frame-ancestors missing from the meta tag?
Browsers ignore frame-ancestors in a meta tag. It only works as an HTTP header, so the meta version leaves it out and a warning reminds you.
What do the warnings mean?
They flag choices that weaken a policy, such as unsafe-inline, unsafe-eval, a wildcard host or a broad scheme like data: or http:. They are prompts to review, not errors.
Can I use nonces and hashes?
Yes. Enter a nonce as nonce-VALUE or a hash as sha256-VALUE and the page adds the quotes. The value must be generated by your server or build tool for each page.