CSP Generator
Easily create a strong Content Security Policy to prevent XSS attacks.
CSP Generator
Build a Content Security Policy header and an HTML meta-policy containing only directives browsers support in meta-delivered CSP.
default-src
Fallback source list for fetch directives.
How to Use the Generated CSP
Once you've configured your policy, you can implement it in two ways:
- HTTP Response Header (Recommended)
Configure your web server to send the
Content-Security-PolicyHTTP header with the generated value. This is the most secure method and supports all CSP features (like report-uri and frame-ancestors). - HTML Meta Tag
If you don't have access to your server configuration, you can add the generated
<meta>tag to the<head>section of your HTML documents. Note that some directives are ignored when delivered via a meta tag.
Special Keywords
CSP uses special keywords that must be enclosed in single quotes:
'self'- Matches the current origin (but not subdomains).'none'- Matches nothing.'unsafe-inline'- Allows inline JavaScript or CSS. (Generally discouraged for security).'unsafe-eval'- Allows text-to-JavaScript functions like eval(). (Generally discouraged).
Related Guides
Deepen your understanding with our expert articles.