Content Security Policy (CSP) Header Generator
Build a Content-Security-Policy header: directives, nonces and strict-dynamic, Google Analytics, AdSense, Fonts and YouTube presets, with nginx, Apache and meta output.
Test with report-only first, open the browser console, and fix the violations before enforcing.
A Content Security Policy tells the browser which sources of scripts, styles, images, frames and connections your page may use, so that injected code cannot run — the strongest browser-side defence against cross-site scripting (XSS). This generator builds the header from a form, adds the hosts Google Analytics, AdSense, Google Fonts and YouTube need, supports nonces and strict-dynamic, and outputs the header, a meta tag and nginx, Apache, Express and _headers snippets.
How to use this tool
- Start from the defaults (everything from your own origin only).
- Add the CDNs and APIs your site loads, or tick the service presets.
- For inline scripts, tick the nonce option and have your server insert a fresh nonce per response.
- Deploy in report-only mode, fix the violations shown in the console, then enforce.
Formula
policy = directive source source …; directive source … (e.g. script-src 'self' https://cdn.example.com)
Keywords ('self', 'none', 'unsafe-inline', 'strict-dynamic', nonces and hashes) must be in single quotes; hosts and schemes (https:, data:) are not. Directives you leave out fall back to default-src, except frame-ancestors, base-uri and form-action, which have no fallback.
Example
The default form gives default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests — a tight policy for a site that hosts all its own files. Ticking Google Analytics adds https://www.googletagmanager.com to script-src and the hosts Google lists for Analytics to img-src and connect-src.
Frequently asked questions
Header or meta tag?
Use the HTTP header when you can. A meta tag works for most directives but cannot set frame-ancestors, report-uri or sandbox, and only applies to content after it in the page.
What is a nonce-based strict CSP?
Instead of listing hosts, every script tag carries a random nonce that changes on each page load, and 'strict-dynamic' lets those trusted scripts load others. It is easier to maintain and harder to bypass than host lists.
Will this break my site?
It can, if something the page needs is not allowed. That is why report-only mode exists: deploy the Content-Security-Policy-Report-Only header first and watch for violations.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/csp-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). Content Security Policy (CSP) Header Generator. https://kakao.mobile/tools/csp-generator/
“Content Security Policy (CSP) Header Generator.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/csp-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms