Content Security Policy (CSP) Builder

Compose a production-ready Content Security Policy header with explicit source directives and copyable server or meta-tag output.

Directive Sources

Use spaces or commas between allowed sources.

default-src

script-src

style-src

img-src

connect-src

font-src

frame-ancestors

base-uri

form-action

upgrade-insecure-requests

Tell browsers to rewrite insecure asset URLs.

block-all-mixed-content

Block insecure subresources on secure pages.

Header Value

Use this value in your server or CDN response headers.

Content-Security-Policy

default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.example.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests

HTML Meta Tag

Useful for prototypes or static HTML pages.

Meta Tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.example.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests" />