How to use: Content-Security-Policy Generator

Content-Security-Policy Generator is a free online Web Tools tool that build a CSP header for nginx, Apache or HTML, with warnings about unsafe-inline and unsafe-eval instantly in your browser. Paste your data, adjust the options and get the result in real time — no installation, no sign-up, and nothing is ever uploaded to a server.

Use Content-Security-Policy Generator now →

Description

Build a CSP header for nginx, Apache or HTML, with warnings about unsafe-inline and unsafe-eval.

  • Web Tools
  • Because everything is computed client-side, Content-Security-Policy Generator is safe to use with sensitive data such as API keys, tokens or private logs.
Input Content-Security-Policy Generator Output Runs 100% in your browser — your data never leaves your device.
Content-Security-Policy Generator — Input → Output

How to use

Using Content-Security-Policy Generator takes three steps:

  1. Paste your data into the input box (or load the example).
  2. Configure the options to match your target format or scenario.
  3. Copy, download or inspect the output — it updates live as you type.
How to use · Content-Security-Policy Generator 1 Paste your data intothe input box (or loadthe example). 2 Configure the optionsto match your targetformat or scenario. 3 Copy, download orinspect the output —it updates live as youtype.
How to use

Run

Examples

Fill in the directives; the generator emits nginx, Apache and meta-tag forms plus a Report-Only variant.

Output (generated live by the tool just now)

Content-Security-Policy

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests

nginx
  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests" always;

Apache (.htaccess)
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests"

HTML meta tag
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests">

Report-only variant (test without breaking the site)
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests

⚠ Review before deploying
  • No report-uri/report-to set — you will not learn about violations in production.

Always deploy with Report-Only first and watch the console for violations.

This output was produced by actually running the tool, not written by hand.

Use cases

Common situations where Content-Security-Policy Generator helps:

  • Build a CSP header for nginx, Apache or HTML, with warnings about unsafe-inline and unsafe-eval.

Parameters

This tool has no options — it works on the input alone.

FAQ

What is Content-Security-Policy Generator?

Content-Security-Policy Generator build a CSP header for nginx, Apache or HTML, with warnings about unsafe-inline and unsafe-eval. It runs entirely in your browser, so your data stays private.

Is Content-Security-Policy Generator free to use?

Yes. Content-Security-Policy Generator is free, unlimited and works without registration or installation.

Does my data get uploaded?

No. All processing happens locally in your browser; nothing is sent to any server.

Good to know

  • Everything runs client-side, so extremely large inputs are limited by your browser tab’s memory rather than by a server upload limit.

Related tools

HTML Meta Tag GeneratorBuild title, description, OG and Twitter card tags.robots.txt GeneratorCompose a correct robots.txt with sitemaps and rules..htaccess Redirect Generator301/302 redirect and HTTPS-force snippets.JSON-LD Structured Data GeneratorCreate schema.org JSON-LD for articles, products and FAQs.Email Address ObfuscatorEncode emails to defeat scrapers.Favicon GeneratorRender text or color into a real .ico file locally.

Content-Security-Policy Generator → · Web Tools →

Use Content-Security-Policy Generator now →