CSP policy builder

Draft a Content Security Policy header with editable source lists and an explicit fallback preview.

Policy preview

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'

Inspect source fallback

Directive	Sources	Reason
script-src	'self'	Explicit
style-src	'self'	Explicit
img-src	'self' data:	Explicit
connect-src	'self'	Explicit
font-src	'self'	default-src fallback
object-src	'none'	Explicit
base-uri	'self'	Explicit
frame-ancestors	'none'	Explicit
form-action	'self'	Explicit

Structural header builder only. Browser behavior, resource loading and policy effectiveness are not tested.

Report-only does not block resources. Reporting endpoints are not configured by this tool.

Directive to edit

Allowed sourcesSpace-separated values for script-src. Empty omits it.

Report-only header

Upgrade insecure requestsAvailable for an enforcing header only.

Draft source rules here; no policy is applied to this page or your server.

Processed on your device

How it works & useful details

How it works & supported syntax

Build an HTTP header from 10 supported source-list directives and optional upgrade-insecure-requests. Empty fields omit a directive. Supports quoted CSP keywords, schemes, ASCII hosts with optional scheme/port/path and nonce/hash source syntax. No credentials, query strings, fragments or IPv6 hosts. Each field supports 30 expressions and 2,000 characters.

Preview explains default-src fallback for supported fetch directives. base-uri, frame-ancestors and form-action do not inherit it. Report-only does not block resources or configure a report endpoint. This builder does not test resource loading, generate nonces, verify hashes or certify a policy’s effectiveness.

Local workspace

Your input stays in this page. These tools calculate or process text; they do not run commands, start containers, contact servers or change settings on your device.

Previews pause above 20,000 combined characters. Use the action to process the full supported input. Exports contain the complete result within the tool’s stated limits.