How to use CSP Header Builder

What it does

Compose strict browser security policies for scripts, styles, images, forms, and frames. It runs entirely in your browser — your input never leaves your device.

Options

Every setting this tool exposes, straight from the code that validates it.

Worked example

Run these settings on the tool page:

• defaultSrc: 'self'
• scriptSrc: 'self'
• styleSrc: 'self'
• imgSrc: 'self'
• connectSrc: 'self'
• fontSrc: 'self'
• frameAncestors: 'none'
• baseUri: 'self'
• formAction: 'self'
• upgradeInsecure: false
• blockMixed: false

You get:

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'

Getting the result you want

Most of the control here is in the options above. If the output is not what you expected, the setting to check first is defaultSrc and scriptSrc — those change the shape of the output rather than the input it accepts.

Troubleshooting

• It is slow on very large input. Everything runs in your browser, so speed depends on your device. Very large inputs are best split up, or run through the API where the work happens on our servers.

Automating it

The same logic is available as a REST endpoint, so you can run it from a script, a CI job or your own app.

Bash
curl "https://api.toolsxpo.com/v1/csp-builder" \
  -H "Authorization: Bearer $TOOLSXPO_KEY"

It costs 1 credit per successful call. See the full endpoint reference, or try it in the playground.

Related tools

• Ansible Playbook Syntax Checker
• Caddyfile Configuration Generator
• Changelog Generator
• Chmod Calculator
• Cron Next-Runs Calculator
• Cron Expression Generator