Home
Tools
Journey
Contact
Login
Safe

CSP Policy Builder & Tester

Security

Visually build, audit, and evaluate Content Security Policy headers (HTTP header, HTML meta tag, or Nginx configuration) with strict-eval warnings.

Select common preset directives (Strict, Balanced, Permissive) or configure fine-grained source lists.
Flags unsafe keywords like 'unsafe-inline' and 'unsafe-eval' that weaken XSS defenses.
Presets & Templates

Select a security profile to automatically populate recommended directive standards.

Security Rating
80 / 100

1 security advisory warning.

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; font-src 'self' data: https:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests;
<meta http-equiv="Content-Security-Policy" ...>
Nginx: add_header Content-Security-Policy "...";

Directives & Scopes

Toggle quick options or add domain whitelists for each directive.

default-src

Fallback directive for fetch directives that are not explicitly specified.

1 active
script-src

Defines valid sources for JavaScript execution.

3 active
style-src

Defines valid sources for stylesheets and inline CSS styles.

3 active
img-src

Defines valid sources of images and favicons.

4 active
connect-src

Restricts URLs loaded using script interfaces (fetch, XHR, WebSockets).

3 active
font-src

Specifies valid sources for fonts loaded using @font-face.

3 active
object-src

Restricts URLs from which plugin types (Flash, Java, Silverlight) can be loaded.

1 active
frame-ancestors

Indicates whether a browser should be allowed to render a page in a frame or iframe (Clickjacking defense).

1 active
base-uri

Restricts the URLs which can be used in a document's <base> element.

1 active
form-action

Restricts URLs which can be used as the target of form submissions.

1 active

More in security utilities

Hash Generator

Compute cryptographic hashes (MD5, SHA-1, SHA-256, SHA-384, SHA-512, HMAC) instantly using Web Crypto API.

JWT Inspector

Decode and inspect JSON Web Tokens (Header, Payload, claims, expiration) client-side without sending tokens anywhere.

Base64 Encoder / Decoder

Encode and decode text, files, and images to/from Base64 with UTF-8 and URL-safe formatting.