CSP Policy Generator
Answer a few questions about your site and we'll generate a ready-to-use Content Security Policy header — no CSP expertise required.
Where does your site load JavaScript from?
How to Generate a Content Security Policy
Writing a CSP from scratch is error-prone. Our generator walks you through the most important directives and builds a safe starting policy. But understanding why each directive exists helps you fine-tune it later.
The OWASP CSP Cheat Sheet ↗ is an excellent companion resource explaining best-practice values for each directive. For the full technical specification, refer to the W3C Content Security Policy Level 3 specification ↗.
Deploying Your CSP Safely
Always deploy a new CSP in Report-Only mode first:
# Step 1 — Report-Only (safe, no blocking) Content-Security-Policy-Report-Only: default-src 'self'; ... # Step 2 — Once violations are resolved, switch to enforcement Content-Security-Policy: default-src 'self'; ...
Mozilla's guide to testing your CSP ↗ explains this workflow in detail. Google also recommends using the CSP Evaluator tool ↗ to spot weaknesses in a generated policy.