Content Security Policy Generator

Generate Content-Security-Policy headers to protect against XSS and injection attacks

Default Source

Script Sources

Style Sources

Image Sources

Font Sources

Connect Sources (API, WebSocket)

Frame Sources

Upgrade Insecure Requests

Block Mixed Content

Result

HTTP Header

Content-Security-Policy: default-src 'self'; upgrade-insecure-requests; block-all-mixed-content

Meta Tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; upgrade-insecure-requests; block-all-mixed-content">

Raw Policy

default-src 'self'; upgrade-insecure-requests; block-all-mixed-content

Security NotesNo security warnings

Generate CORS headers

Generate SRI hashes

Check your security headers