{ }Free
Content Security Policy builder
Generate a conservative source allowlist policy for review.
Generate a conservative source allowlist policy for review. Validate HTTPS origins and use them in script, style and image source allowlists with a self-only default. Object embedding is blocked, and base and framing policies are included.
How to use
- Enter your text, values, or image.
- Adjust the options and run the tool.
- Copy or download your result.
Worked example
Example input
Allowed HTTPS origins, one per line: https://cdn.example.com
Example result
default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' https://cdn.example.com; img-src 'self' data: https://cdn.example.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Limitations and details
Only HTTPS origins are accepted; per-directive controls, report-only headers and testing against your application are not generated.
Inputs and options
- Allowed HTTPS origins, one per line
- Text
Frequently asked questions
Is this tool free and private?
Yes. All 300 tools are free in this phase. Processing happens in your browser; your input and files are not sent to our servers.