CSP Generator

Compose Content-Security-Policy directives for your site.

Interactive controls load with JavaScript. Processing stays in your browser—nothing is uploaded.

Načítání…

Jak používat

  1. Open CSP Generator — Load the page.
  2. Select directives — Toggle sources you need.
  3. Generate header text — Copy Content-Security-Policy value.
  4. Deploy on your host — Apply via CDN/host headers.

Omezení

Requires JavaScript. Extremely large inputs may slow the browser tab. Results depend on your browser APIs; there is no server-side processing quota because nothing is uploaded.

When to use

When you want a quick, free utility without creating an account or sending content to an online converter.

When not to use

When you need server-side integration, batch automation at scale, or certified compliance tooling.

Privacy note

Tool inputs are processed in your browser only. Theme, language and favorites may use localStorage; hosting may keep standard access logs (IP, UA, URL) without tool payloads.

FAQ（5）

Report-only?

You can draft Content-Security-Policy-Report-Only separately in your host config.

Nonce/hash?

Add nonces/hashes in your app; this tool helps compose directive text.

Uploaded?

No.

Breaks site?

Start in report-only, watch violations, then enforce.

Inline scripts?

Prefer nonces or hashes over 'unsafe-inline'.