🛡️ CSP Builder

Enter sources for each directive (space-separated — e.g. 'self' https://cdn.example.com) to build a Content-Security-Policy header string. Leave a field blank to omit that directive.

default-src

script-src

style-src

img-src

connect-src

font-src

frame-ancestors

object-src

How the header is assembled

Every field you fill in becomes one directive; blank fields are dropped. The eight defaults on this page, with font-src left empty, join into:

Content-Security-Policy: default-src 'self'; script-src 'self';
style-src 'self' 'unsafe-inline'; img-src 'self' data:;
connect-src 'self'; frame-ancestors 'none'; object-src 'none';

An omitted fetch directive falls back to default-src - leaving font-src blank means fonts must come from your own origin. frame-ancestors is the exception people trip over: it has no fallback, so if you clear that box, nothing stops your pages being framed.

Syntax that bites

Keywords need the quotes, hosts must not have them. 'self', 'none' and 'unsafe-inline' are quoted; https://cdn.example.com is bare. Writing script-src self allows a host literally named "self".
The default style-src here allows inline styles. That is a deliberate compromise, and a far smaller risk than allowing inline script - but a nonce is better if your templates can carry one.
Schemes are sources too. data: in img-src is routine; data: in script-src re-opens the hole the policy is there to close.

This builder writes a string - it does not read your site or tell you whether the policy fits it. Ship it as Content-Security-Policy-Report-Only first and watch the console violations for a week before you enforce.

Frequently asked questions

Does unsafe-inline make a CSP pointless?

In script-src it removes most of the protection, because injected inline script is exactly what a policy is meant to stop. Replace it with a per-request nonce or a hash of each script; browsers that see a nonce or hash ignore unsafe-inline, so you can keep both while you migrate.

Why did Google Fonts stop loading after I added a CSP?

The stylesheet comes from fonts.googleapis.com and the font files from fonts.gstatic.com, so you need both style-src and font-src to name them. Leaving font-src blank sends it to default-src, which here is your own origin.

Do I still need X-Frame-Options?

Not for current browsers. Any browser that understands frame-ancestors ignores X-Frame-Options entirely, and frame-ancestors is the more capable of the two. Keeping the old header alongside it does no harm.