Free CSP generator tool. Create custom Content Security Policy headers to prevent XSS attacks, clickjacking, and code injection.
Content Security Policy uses directives to control which resources can be loaded and executed.
• default-src: Fallback for all resource types
• script-src: JavaScript sources
• style-src: CSS stylesheets
• img-src: Image sources
• connect-src: AJAX, WebSocket, fetch
• font-src: Web fonts
• frame-src: Iframe sources
• 'self': Same origin only
• 'none': Block all sources
• 'unsafe-inline': Allow inline code (avoid)
• 'unsafe-eval': Allow eval() (avoid)
• https: Any HTTPS source
• domain.com: Specific domain
Content Security Policy (CSP) is an HTTP security header that controls which resources a browser is allowed to load and execute on a web page. By defining a whitelist of trusted content sources, CSP prevents Cross-Site Scripting (XSS), data injection attacks, clickjacking, and other code injection vulnerabilities. It is one of the most effective client-side security controls available and is recommended by OWASP, NIST, and every major web security standard.
XSS remains the most common web vulnerability, affecting approximately 65% of web applications. CSP provides defense-in-depth against XSS by ensuring that even if an attacker injects malicious HTML, the browser refuses to execute unauthorized scripts, load unauthorized resources, or submit data to unauthorized endpoints.
CSP is delivered as an HTTP response header that specifies directives controlling different resource types:
| Directive | Controls | Example |
|---|---|---|
| default-src | Fallback for all resource types | default-src 'self' |
| script-src | JavaScript sources | script-src 'self' cdn.example.com |
| style-src | CSS stylesheets | style-src 'self' 'unsafe-inline' |
| img-src | Image sources | img-src 'self' data: images.example.com |
| font-src | Web fonts | font-src 'self' fonts.googleapis.com |
| connect-src | AJAX, WebSocket, fetch targets | connect-src 'self' api.example.com |
| frame-src | Iframe sources | frame-src 'none' |
| object-src | Plugins (Flash, Java) | object-src 'none' |
| base-uri | Allowed | base-uri 'self' |
| form-action | Form submission targets | form-action 'self' |
| frame-ancestors | Who can embed this page | frame-ancestors 'none' |
| report-uri / report-to | Where to send violation reports | report-to csp-reports |
Source values:
'self' — Same origin only'none' — Block all resources of this type'unsafe-inline' — Allow inline scripts/styles (weakens CSP significantly)'unsafe-eval' — Allow eval() and similar (weakens CSP significantly)'nonce-{random}' — Allow specific inline scripts with a matching nonce'strict-dynamic' — Trust scripts loaded by already-trusted scriptsscript-src 'nonce-abc123'Content Security Policy (CSP) is HTTP response header that controls resources browsers can load. Prevents XSS, clickjacking, code injection by whitelisting trusted sources. Example: Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com. Directives: script-src (JavaScript), style-src (CSS), img-src (images), connect-src (AJAX/WebSocket). Modern browsers support CSP Level 3. Essential defense layer for web security.
Add CSP header to HTTP responses. Methods: web server config (Nginx, Apache), meta tag in HTML head (limited features), application framework middleware, CDN/WAF rules. Example Nginx: add_header Content-Security-Policy "default-src 'self'"; Start with Content-Security-Policy-Report-Only to test without blocking. Monitor CSP violation reports. Gradually tighten policy. Remove inline scripts/styles or use nonces. Deploy in production when violations resolved.
Nonce (number used once) is cryptographic random value allowing specific inline scripts/styles. Add nonce='random123' to CSP header and matching nonce="random123" to script/style tags. Browser compares nonces. Prevents XSS - attacker cannot guess nonce. Generate new nonce per page load using CSPRNG. Example: script-src 'nonce-4AEemGb0xJptoIGFP3Nd'. Alternative to unsafe-inline. Requires server-side rendering. More secure than hashes for dynamic content.
Key directives: default-src (fallback for all), script-src (JavaScript sources), style-src (CSS), img-src (images), font-src (web fonts), connect-src (fetch/XHR/WebSocket), frame-src (iframes), media-src (video/audio), object-src (plugins), base-uri (base tag), form-action (form submissions). Values: 'self' (same origin), 'none' (block all), https: (any HTTPS), specific domains. Use default-src as baseline, override with specific directives.
Three methods: 1) Nonces - unique token per page load (most secure). 2) Hashes - SHA-256/384/512 hash of script content (for static scripts). 3) unsafe-inline (insecure, avoid). Example with hash: script-src 'sha256-abc123...'. Generate hash: echo -n "alert('hello')" | openssl dgst -sha256 -binary | openssl base64. Best practice: move inline scripts to external files, use nonces for necessary inline code. Avoid unsafe-inline - negates XSS protection.
Content-Security-Policy-Report-Only header tests CSP without blocking resources. Browsers log violations but do not enforce policy. Use to: test new CSP before deployment, identify resources needing whitelisting, monitor for policy violations. Reports sent to report-uri or report-to endpoints. Example: Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report. Deploy report-only first, fix violations, then enforce with Content-Security-Policy header.
Whitelist trusted third-party domains explicitly. Example: script-src 'self' https://cdn.jquery.com https://www.google-analytics.com. Challenges: CDNs (use SRI hashes), ads (relaxed policies needed), social widgets (frame-src), analytics (connect-src). Solutions: host resources locally, use SRI for CDN files, frame third-party content (iframe sandbox), proxy external resources. Balance security vs functionality. Review third-party integrations quarterly. Remove unused scripts.
SRI validates that CDN-hosted files have not been tampered with. Add integrity attribute with cryptographic hash to script/link tags. Example: <script src="https://cdn.example.com/lib.js" integrity="sha384-..." crossorigin="anonymous">. Browser verifies hash before executing. Prevents supply chain attacks (compromised CDN). Generate hashes: openssl dgst -sha384 -binary file.js | openssl base64. Use with CSP for defense in depth. Update hashes when upgrading libraries.