Build secure CSP headers for your website – with templates, validator, and live preview.
Content Security Policy (CSP) protects your website from Cross-Site Scripting (XSS) and other injection attacks. Our generator helps you create the right CSP for your website – without manually writing the complex syntax.
Choose a template as a starting point, customize the directives to your needs, and copy the finished header into your website. Use the built-in validator to check and improve existing CSPs.
Content Security Policy is an HTTP security header that tells your browser which resources (JavaScript, CSS, images, fonts) are allowed to load on your website. CSP is one of the most effective defenses against Cross-Site Scripting (XSS) – one of the most common security vulnerabilities on the web.
When an attacker tries to inject malicious JavaScript into your website, a well-configured CSP blocks execution – even if the code was successfully injected.
WordPress websites are among the most targeted. A CSP provides:
script-src https: allows ALL HTTPS domains as script sources – almost as insecure as having no CSP at all.For WordPress, we recommend starting with our WordPress Standard template and testing the policy in Report-Only mode. This lets you see in the browser console which resources would be blocked, without actually breaking your site.
Yes, the generator is completely free and requires no registration.
No. All CSP generation runs directly in your browser. We do not transmit any data to servers.
'unsafe-inline' allows all inline scripts – including those injected by attackers. Nonces (cryptographic one-time tokens) only allow specific, server-authorized inline scripts. Nonces are significantly more secure.
Yes! Select ".htaccess" in the format dropdown to get the ready-to-use Apache header code. Add it to your .htaccess file in the WordPress root directory.
With the Content-Security-Policy-Report-Only header, the policy is reported but not enforced. This lets you test a new CSP without breaking your website. Violations are reported in the browser console (and optionally to a report endpoint).