CSP Header Generator
Build a Content-Security-Policy header step by step with presets for Google Analytics, AdSense, Fonts and YouTube. Copy ready code.
Services you use (adds their domains)
default-src Fallback for every type not listed below.script-src JavaScript.style-src Stylesheets.img-src Images.font-src Web fonts.connect-src fetch, XHR, WebSocket.media-src Audio and video.frame-src Pages you embed in iframes.worker-src Web workers.object-src Plugins (<object>, <embed>).base-uri Allowed <base> URLs.form-action Where forms may submit.frame-ancestors Who may embed your site (clickjacking protection).HTTP header
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
Apache (.htaccess)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
HTML meta tag
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests">
frame-ancestors and report-uri only work as a header, so they’re left out of the meta tag.
Ad space · responsive
How to use CSP Header Generator
- Pick the services your site uses (analytics, AdSense, fonts…).
- Adjust each directive's sources.
- Copy the header, or the nginx / Apache line — start in Report-only mode to test.
Good to know
- Test a new policy with Content-Security-Policy-Report-Only first — a too-strict policy breaks pages.
Privacy
Runs entirely in your browser. Nothing you enter or open here is uploaded.
Questions
Why does AdSense need 'unsafe-inline'?
AdSense injects inline scripts and frames from many Google domains. If you can, use nonces instead; otherwise accept the weaker script policy on pages with ads.