CSP Header Generator Online Free
Build secure Content Security Policy (CSP) headers for your website. Define source permissions for scripts, stylesheets, images, fonts, frames, and other directives visually.
CSP Header Generator
Build Content Security Policy headers for scripts, styles, images, fonts and other directives.
Add this HTTP response header to your server configuration.
How to Use This Tool
Select Default Policy
Choose default-src parameters (e.g. 'self') to secure unmapped resource types.
Map Resource Sources
Add approved domains or wildcard lists for script-src, style-src, and img-src.
Toggle Security Directives
Enable strict parameters like upgrade-insecure-requests or block-all-mixed-content.
Copy Header output
Copy the generated header string to place in your web server (Nginx, Apache, IIS) configuration.
Securing a web app with Google Fonts and Analytics
You need to secure your app while allowing Google Fonts and Google Analytics scripts to run. Select 'self' as default. In script-src, add '*.google-analytics.com'. In style-src, add 'fonts.googleapis.com'. The builder outputs the correct CSP string instantly.
Common Use Cases
XSS Defense
Configure web security headers to mitigate cross-site scripting vulnerabilities.
DevOps & Deployment
Generate compliant security headers for web applications, CDNs, and proxy configurations.
Web Audits
Align with OWASP standards by applying strict Content Security Policy directives.
Academic Training
Learn key CSP directives like object-src, frame-ancestors, connect-src, and sandbox.