CSP Builder.
Construct a Content-Security-Policy directive by directive with plain-English explanations, validate a policy you already have, or paste a page's HTML to see exactly what a policy would block — and get a suggested minimal policy. Everything runs in your browser.
Fallback for every fetch directive you do not set explicitly. Set this to lock everything down, then open up specific resource types.
Where scripts may load from, and whether inline/eval are allowed. The most security-critical directive — XSS lives here.
Where stylesheets may load from, and whether inline styles are allowed.
Where images (including favicons and srcset) may load from.
Endpoints reachable via fetch/XHR, WebSocket, EventSource, and sendBeacon.
Where web fonts may load from (@font-face src).
Sources allowed in <iframe> / <frame>. Falls back to child-src then default-src.
Where <audio>, <video>, and <track> may load from.
Sources for <object>/<embed> plugins. Almost always should be ’none’.
Where Worker, SharedWorker, and ServiceWorker scripts may load from.
Where the web app manifest may load from.
Restricts the <base> element. Set to ’self’ (or ’none’) to stop an injected <base> from hijacking every relative URL.
Where forms may submit. Limits exfiltration via injected <form action>.
Who may embed this page in a frame — the modern replacement for X-Frame-Options. Use ’none’ to block clickjacking.
Other directives
Reporting
Paste a Content-Security-Policy
1 · Paste a page's HTML
2 · Policy to test against
What this policy would block
Page inventory
How a Content-Security-Policy works
A CSP is a response header (or <meta> tag) that tells the browser which
sources of script, style, images, and other resources are trusted. Anything not on the list
is blocked, which is why CSP is one of the strongest defenses against cross-site scripting.
Start fail-closed
Set default-src 'self', then open up only the resource types and origins you actually use. Unset directives fall back to default-src.
Avoid 'unsafe-inline'
Prefer a per-response nonce-… on each inline <script>, paired with 'strict-dynamic' for a policy that scales without host allowlists.
Don't forget the “quiet” directives
object-src 'none', base-uri 'self', and frame-ancestors 'none' close common bypasses and clickjacking — they aren't covered by default-src.