Configure CSP Directives

default-src (Fallback Policy)

Default origin for all unspecified resource directives.

script-src (JavaScript Origins)

Defines valid sources for JavaScript files and inline scripts.

style-src (CSS Stylesheets)

Allowed origins for CSS stylesheets and font styling.

img-src (Images & Icons)

Sources from which images and favicons may be loaded.

font-src (Web Fonts)

Allowed web font origins (e.g. fonts.gstatic.com, data:).

connect-src (AJAX / Fetch / WebSocket)

Origins accessible via fetch, XMLHttpRequest, and WebSockets.

frame-ancestors (Clickjacking Defense)

Specifies parents that may embed this page in <iframe>.

upgrade-insecure-requests

Forces all HTTP asset requests to HTTPS before loading.

Frequently Asked Questions

CSP is an HTTP response header that restricts which domain origins can execute scripts, load stylesheets, fonts, and iframes, mitigating Cross-Site Scripting (XSS) attacks.

You can add it to your server configuration (Nginx or Apache), send it via PHP `header()` function, or place it inside a `<meta http-equiv="Content-Security-Policy">` HTML tag.

Content Security Policy (CSP) Builder

Free Tool

Generate strict, secure Content-Security-Policy (CSP) HTTP response headers to protect your website against XSS and clickjacking.

Instant 0ms 100% Client-Side

XSS & Clickjacking Prevention Engine

Content Security Policy (CSP) Builder

Visually generate strict, production-ready Content-Security-Policy headers for Nginx, Apache, PHP, and HTML meta tags.

Configure CSP Directives

default-src (Fallback Policy)

Default origin for all unspecified resource directives.

script-src (JavaScript Origins)

Defines valid sources for JavaScript files and inline scripts.

style-src (CSS Stylesheets)

Allowed origins for CSS stylesheets and font styling.

img-src (Images & Icons)

Sources from which images and favicons may be loaded.

font-src (Web Fonts)

Allowed web font origins (e.g. fonts.gstatic.com, data:).

connect-src (AJAX / Fetch / WebSocket)

Origins accessible via fetch, XMLHttpRequest, and WebSockets.

frame-ancestors (Clickjacking Defense)

Specifies parents that may embed this page in <iframe>.

upgrade-insecure-requests

Forces all HTTP asset requests to HTTPS before loading.

Frequently Asked Questions

CSP is an HTTP response header that restricts which domain origins can execute scripts, load stylesheets, fonts, and iframes, mitigating Cross-Site Scripting (XSS) attacks.

You can add it to your server configuration (Nginx or Apache), send it via PHP `header()` function, or place it inside a `<meta http-equiv="Content-Security-Policy">` HTML tag.

Explore More Free Utilities

Wealth Growth Simulator

Open Port Checker

Remote TCP Scanner