Skip to content

CSP Header Generator

Build a Content Security Policy starting point with heuristic scoring — or inspect a website's current response header.

Part of AppSec Santa's free website security scanners — no signup.

Build CSP Headers Interactively

Pick a starting template, adjust its directives, and review a heuristic score before testing the policy on your site.

  • Heuristic A+ to F grade with listed findings
  • Warnings for unsafe-inline and unsafe-eval
  • Click-to-toggle directive sources
  • Builder and hash calculator run in your browser
CSP Header Generator builder interface showing A+ security grade, directive toggles for default-src, script-src, style-src, and real-time scoring

4 Starting Templates for Common Setups

Start with a basic self-only policy or a preset for an SPA, WordPress, or a static site. Each preset needs testing and site-specific changes.

  • Basic self-only starting policy
  • Permissive WordPress preset that should be tightened
  • Static site lockdown (default-src 'none')
  • Customize any template after loading
CSP Generator template selector with pill-style Generate and Analyze mode switcher, template dropdown, and Start Building button

Export to Any Server Platform

One-click copy for nginx, Apache, Express, Next.js, Cloudflare, or a meta tag. The output is formatted for common config files; test it in Report-Only mode before enforcement.

  • 7 export formats with proper escaping
  • Warnings for meta tag limitations
  • SHA-256 hash calculator for inline scripts
  • Analyze any site's CSP and edit it
CSP export format tabs showing HTTP Header, Meta Tag, nginx, Apache, Express, Next.js, and Cloudflare options with generated nginx config

Frequently Asked Questions

What is a Content Security Policy (CSP)?

A Content Security Policy is usually delivered as an HTTP response header that restricts which resources a browser may load or execute. It can mitigate XSS and other injection risks, but it is a defense-in-depth control rather than a substitute for fixing bugs.

Is this CSP generator free?

Yes. The builder and hash calculator run in your browser. Analyzer mode sends the URL you enter to AppSec Santa's backend, which requests the site and inspects its response headers.

What CSP score should I aim for?

The grade is a heuristic for the checks listed in the results, not a browser guarantee, penetration test, or compliance result. Use the findings to prioritize changes, then validate the policy in Report-Only mode and test the application before enforcement.

What is the difference between unsafe-inline and nonce-based CSP?

When active, unsafe-inline broadly permits inline script. A nonce-based policy instead uses an unpredictable value generated for each HTTP response and applies it only to trusted script elements; hash-based policies are another option for static content.

Will CSP break my website?

A restrictive policy can block resources your site needs. Deploy it first with Content-Security-Policy-Report-Only, inspect violations, and test critical flows before switching to the enforcing header.

Can I use CSP in a meta tag instead of an HTTP header?

Yes, but a meta-delivered policy does not support every CSP feature. For example, frame-ancestors and sandbox are ignored, and Report-Only cannot be delivered this way. Prefer an HTTP response header when you control the server.

Check Your Full Security Headers

CSP is one part of a browser security-header posture. Run a full scan to check related controls such as HSTS, CORS, and X-Frame-Options.

Check Security Headers