CSP Policy Tools
Build Content-Security-Policy headers and inspect pasted CSP directives.
Sensitive data: Anything you enter is processed in your browser only. It is never uploaded or logged on a server.
Building and inspecting Content-Security-Policy headers
Content-Security-Policy (CSP) controls which scripts, styles, images, and frames a browser may load. Builders turn directive lists into a single header or meta tag you can paste into nginx, Cloudflare, or static HTML. Inspectors parse an existing policy into a directive table so reviews catch unsafe-inline, unsafe-eval, and wildcard sources.
Search intent for CSP builder and CSP inspector is operational: ship a stricter policy without memorizing every directive. Prefer default-src with explicit script-src and style-src overrides. Add frame-ancestors and base-uri early to reduce clickjacking and base-tag injection risk.
Common pitfalls: using * for script-src, enabling unsafe-inline to silence console noise, and copying Report-Only policies into enforcing mode without a dry run. Meta tags cannot set frame-ancestors; use HTTP headers for that directive.
Draft CSP locally when host allow lists include internal CDNs or partner origins. Browser-side generation keeps staging hostnames off public pastebins during security reviews.
Reference Guide
Security tool - all processing runs locally in your browser. No data is sent to a server.
Operation: csp-build
Paste input, click Run, and copy the result. For two-input tools, fill both fields before running.
Example Input
default-src: 'self' script-src: 'self' https://cdn.example.com img-src: 'self' data: frame-ancestors: 'none' base-uri: 'self'
A sample loads automatically when you open this tool. Use Load Sample to reset it.