Content Security Policy generator
Build a Content-Security-Policy header from the sources your site uses.
FreeRuns in your browserNo signupUpdated 2026-11-05
Services your site uses
Extra sources by directive
Directives follow MDN's CSP reference. Service hosts come from each provider's own CSP guidance, last checked November 2026.
Directives
11
490 characters in the policy
Checks
1 to review
Content-Security-Policy
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https://www.googletagmanager.com https://*.google-analytics.com data:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://www.googletagmanager.com https://*.google-analytics.com https://*.google.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests
Checks
- Check'unsafe-inline' in script-src lets any injected inline script run. Move to nonces when your server can generate one per request.
- NoteGoogle Analytics 4 (gtag.js): The gtag snippet is an inline script, so it needs a nonce or 'unsafe-inline'. Google Ads features need more hosts.
Start in report-only mode, watch the browser console or your report endpoint for a week, then switch to enforcing.
About this tool
How it works and how to read the result.
Need this done for you?
Website care & maintenance
Hosting, updates, backups and fixes, handled for you.
See the serviceWhat it does
A Content Security Policy is a response header that tells the browser which sources a page may load scripts, styles, images, fonts and frames from. If an attacker injects a script tag pointing at their own server, the browser refuses to run it. This generator builds the header from the services you tick, adds any extra hosts you list, applies sensible hardening rules, and writes the result for a raw header, Nginx, Apache, Next.js, vercel.json or an HTML meta tag. Host lists for Google Analytics, Tag Manager, reCAPTCHA and Stripe come from each provider's own CSP guidance.
How to use it
- Tick the third-party services the site loads.
- Choose how to handle inline scripts. Most WordPress and Next.js sites without nonces need 'unsafe-inline' to start with.
- Add any other hosts under "Extra sources", such as a CDN, a chat widget or an image service.
- Add a report endpoint and turn on report-only mode for the first rollout.
- Pick your server's format, copy the code and deploy it.
How to read the result
With the defaults (Google Analytics 4 and Google Fonts ticked, inline scripts and styles allowed) the policy has 11 directives. It starts with default-src 'self', so anything not listed falls back to your own domain. script-src adds www.googletagmanager.com, img-src and connect-src add the Google Analytics hosts, style-src adds fonts.googleapis.com and font-src adds fonts.gstatic.com. The last directives, object-src 'none', base-uri 'self' and form-action 'self', close common gaps that default-src does not cover.
The Checks stat shows one item to review: 'unsafe-inline' in script-src. That is a trade-off rather than an error. It keeps inline snippets such as the gtag code working, but it also lets injected inline code run. The Note under it reminds you that Google Ads features need more hosts than Analytics alone.
frame-ancestors 'self' stops other sites from showing your pages in an iframe, which protects against clickjacking. It does not fall back to default-src, so it is set separately.
When the browser blocks something, it logs a message naming the directive and the blocked URL. Add that host to the matching directive and test again.
Content Security Policy is one of several security headers we set and monitor in our website maintenance service. If a policy breaks a redirect or a crawler, check the HTTP status codes reference.
Questions
Frequently asked.
Will a Content Security Policy break my site?
It can, which is why you should start in report-only mode. The browser then logs what the policy would have blocked without blocking anything. Fix the gaps, usually a forgotten analytics, chat or font host, then switch to enforcing. Check the browser console on your main page types before you do.
Is a meta tag as good as a header?
Not quite. A meta tag cannot set frame-ancestors, report-uri, report-to or sandbox, and it cannot run in report-only mode, so you lose clickjacking protection and reporting. It also only applies to content after the tag. Use it when you cannot change server headers, for example on some hosted platforms.
What is the difference between 'unsafe-inline' and a nonce?
'unsafe-inline' lets every inline script run, including one an attacker manages to inject, so it removes most of the protection CSP offers against cross-site scripting. A nonce is a random value your server puts in the header and on each script tag it trusts; injected scripts do not know it, so they are blocked.
Your next move
Like what you see? Tell us about it.
A process that takes too long, a website that undersells you, or an idea ready to take shape. Tell us where you are and we will suggest a useful next step.
India · Working with clients worldwide