CSP Builder

Build a Content-Security-Policy header from common directives.

Runs in this tab. We do not upload what you paste.

Build a Content-Security-Policy header sketch. Test carefully — CSP breaks sites easily.

default-src

'self''none'

script-src

'self''unsafe-inline''unsafe-eval'https:

style-src

'self''unsafe-inline'https:

img-src

'self'data:https:blob:

font-src

'self'data:https:

connect-src

'self'https:wss:

frame-ancestors

'self''none'

base-uri

'self''none'

form-action

'self'

object-src

'none'

Extra connect-src hosts

Content-Security-Policy

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.example.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none';

meta tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.example.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none';" />

How to use this

Paste or type into the fields above. Nothing leaves this tab.
Read the result, then copy it into your editor or ticket.
For production pipelines, use your normal toolchain. This page is for a fast check.

About CSP Builder

Build a Content-Security-Policy header from common directives. Processing stays in your browser, so drafts, tokens, and configs are not sent to Myrafy.