// TOOLS

Security Tools

🧱 CSP Builder

Build your Content-Security-Policy directive by directive, one click per source plus your hosts. It warns about what lets XSS through (unsafe-inline, wildcards) and the hardening directives you are missing. Outputs the header and the <meta>.

Presets
Directives
Generated header

Frequently asked questions

What is a Content-Security-Policy?
It is an HTTP header that tells the browser which origins it may load scripts, styles, images, etc. from. Configured well, it is one of the most effective defenses against XSS.
Why does it warn about 'unsafe-inline'?
Because it allows inline scripts to run, which is exactly what an XSS abuses; it defeats much of the CSP's protection. Use nonces or hashes instead.
HTTP header or <meta> tag?
The HTTP header is recommended: it supports every directive, including frame-ancestors. The <meta> tag is a fallback when you cannot touch the server configuration, but it has limitations.