CSP and security headers

Build a Content-Security-Policy, review its flaws and export the headers for nginx, Apache, Netlify or Caddy.

Processed in your browser · Check it yourself Nothing sentData sent: 0 · To other domains: 0Analytics: not present · Ads: not present

Directives

Sources separated by spaces. Empty = not defined.

default-srcscript-srcstyle-srcimg-srcfont-srcconnect-srcmedia-srcobject-srcframe-srcworker-srcmanifest-srcbase-uriform-actionframe-ancestors

Other security headers HSTS (force HTTPS) X-Content-Type-Options Referrer-Policy Permissions-Policy Cross-Origin-Opener-Policy

Report only: it does not block, useful for testing

Output format

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Review

✓ No warnings: the policy covers the basics.

Import an existing policyPaste the header value (with or without its name) and it loads into the editor.

More in Security

Learn step by step in the pathSecuring your website