Content Security Policy (CSP) Generator / Builder
Build a Content Security Policy header interactively, directive by directive.
About CSP Builder
Builds a Content Security Policy header interactively — selecting which sources are allowed to load scripts, styles, images, fonts, and other resource types for a page, and assembling the correct directive syntax. CSP is one of the most effective defenses against XSS, but also one of the easiest headers to get wrong by hand, since a single missing directive or an overly permissive wildcard can either break legitimate page functionality or quietly defeat the protection. Testing a new policy in Content-Security-Policy-Report-Only mode before enforcing it catches what would have broken without breaking it in production first.
Adding 'unsafe-inline' or 'unsafe-eval' to get a broken page working again defeats most of what CSP protects against — if a policy needs either to function, the page's own inline scripts or styles are the actual thing to fix.