CSP Header Builder

Build Content Security Policy headers

Browser ProcessingYour data never leaves your browser

default-src

'self'

'none'

'unsafe-inline'

'unsafe-eval'

script-src

'self'

'none'

'unsafe-inline'

'unsafe-eval'

style-src

'self'

'none'

'unsafe-inline'

img-src

'self'

data:

blob:

font-src

connect-src

frame-src

Additional Options

upgrade-insecure-requests

block-all-mixed-content

report-uri

CSP Header

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'

Meta Tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'">

Related Tools