Free · no signup · browser-local
Content Security Policy Header and Meta Tag Builder
Prepare a CSP from editable directives and inspect the header and compatible meta output. See which directives need a response header before deployment.
Result
Choose inputs and run the tool to see the result.
Getting started
Start with the restrictive same-origin template, edit directives for your site, then generate and copy the header or meta tag.
Before you use the result
A generated policy is not a security audit. Test with a report-only response header before enforcement. Meta cannot enforce frame-ancestors or sandbox and cannot deliver reporting directives.
Try an example
Start with default-src self; object-src none; frame-ancestors none to normalize quoted keywords and inspect meta omissions.
How it works
Normalize recognized source keywords, reject duplicate or unsupported directives and malformed tokens, and remove header-only directives from escaped meta output.
Frequently asked questions
Build a CSP response header and a compatible meta tag from editable common directives.
How do I use Content Security Policy Builder?
Start with the restrictive same-origin template, edit directives for your site, then generate and copy the header or meta tag.
Does this tool upload my data?
Inputs and files are processed in your browser. Page-view analytics do not contain your tool input.
What should I check before using the result?
A generated policy is not a security audit. Test with a report-only response header before enforcement. Meta cannot enforce frame-ancestors or sandbox and cannot deliver reporting directives.