How to use this tool
- Choose a starting preset and edit one directive per line.
- Add trusted HTTP(S) origins, supported keywords or complete SHA hashes.
- Start in report-only mode; review violations in your application before enforcing.
Start with a report-only policy
Observe browser violations before enforcing resource restrictions on an existing application.
Input
default-src 'self' object-src 'none' base-uri 'self'
Expected output
Content-Security-Policy-Report-Only: default-src 'self'; object-src 'none'; base-uri 'self'
Use the report-only header while inventorying required origins, then test enforcement. The builder does not host a report endpoint. Nonces must be generated freshly per response; copying a static nonce or adding unsafe-inline broadly is not a substitute.
More examples
- default-src 'self' restricts fallback fetch sources to the same origin.
- object-src 'none' blocks plugin resources; frame-ancestors 'none' blocks embedding.
- A nonce must be generated by your server on each response; static nonce examples are rejected.
Know the limits
A generated policy does not make a site secure. Strict presets can break applications. Reporting destinations and fresh nonce integration must be configured in your own server.
Common questions
Does report-only block resources?
No. Report-only observes violations; configure reporting separately to receive reports.
Why reject CR characters?
A pasted CRLF can attempt HTTP header injection. Only deliberate newline directive separators are supported.