CSP Generator
Build Content Security Policy headers visually with toggleable directives and sources.
Fallback security perimeter for unstated directives
Valid executable JavaScript origins
Valid CSS stylesheets & typography origins
Permitted image and favicon sources
Web fonts loaded via @font-face
Fetch, XMLHttpRequest, WebSocket, and Beacon endpoints
Audio and video stream origins (<audio>, <video>)
Plugins (<object>, <embed>, <applet>) - Recommend 'none'
Valid child iframe and embed destinations
Web Worker, SharedWorker, and ServiceWorker scripts
PWA web application manifest origins
Restricts URLs that can appear in a document's <base> element
Restricts valid endpoints for form submissions
Clickjacking defense: Who can embed this page via iframe
Instructs browsers to treat all HTTP URLs as HTTPS
Prevents loading any HTTP content over HTTPS
Security Risk Assessment
Cross-Site Scripting (XSS) Defense
Content Security Policy (CSP) restricts executable script origins, mitigating reflected, stored, and DOM-based XSS attacks.
Multi-Platform Server Configs
Generate ready-to-deploy code snippets for Next.js App Router, Nginx, Apache .htaccess, and Cloudflare Workers.
Live Vulnerability Audit
Inspect dangerous directives in real time, alerting you to unsafe-inline and unsafe-eval vectors before pushing to production.
Frequently Asked Questions
Is CSP Generator free to use?
How does CSP Generator protect my privacy and data?
Does CSP Generator work on mobile devices?
What are the main features of CSP Generator?
More Security & Privacy Utilities
Password Generator
Generate cryptographically secure passwords with customizable length, character sets, and strength meter. Create up to 10 at once.
Security Scanner
Scan any website for security misconfigurations. Checks 12 security headers and gives an A+ to F grade.
SSH Key Generator
Generate RSA SSH key pairs (2048/4096 bit) in your browser. OpenSSH and PEM formats.