Client-side tool

Content Security Policy Builder

Assemble a strict CSP starter policy, test it in report-only mode, and copy the complete HTTP header.

Processing stays in your browser

default-srcscript-srcstyle-srcimg-srcfont-srcconnect-srcobject-srcbase-uriframe-ancestors

Upgrade insecure requestsReport-only header

Generated header

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; upgrade-insecure-requests;

Start in report-only mode, inspect violations, then enforce. A useful CSP is application-specific; add trusted origins narrowly instead of using wildcards.