Skip to main content
SlapMyWeb
Slap a site
Skip to tool
Security & Network

CSP Header Generator

Build Content-Security-Policy headers visually with presets and per-directive controls

  • 100% free
  • No sign-up
  • Clear controls
  • Open and use
default-src

Fallback for all fetch directives

script-src

Valid sources for JavaScript

style-src

Valid sources for stylesheets

img-src

Valid sources for images

font-src

Valid sources for fonts

connect-src

Valid targets for fetch/XHR/WebSocket

media-src

Valid sources for audio/video

frame-src

Valid sources for iframes

object-src

Valid sources for plugins (Flash, etc.)

base-uri

Valid URLs for <base> element

form-action

Valid targets for form submissions

frame-ancestors

Who can embed this page (clickjacking protection)

upgrade-insecure-requests

Auto-upgrade HTTP to HTTPS

Generated Header
Content-Security-Policy: default-src 'self'
What this tool does
  • Visual per-directive configuration
  • 3 security presets (Strict, Moderate, Permissive)
  • Custom domain allowlisting
  • Report-Only mode toggle
Want the whole picture? Run a free website audit for a score and prioritised issues. No signup needed to start.Run a free audit
The short version

What is CSP Header Generator?

A Content-Security-Policy (CSP) header tells browsers which resources are allowed to load on your page.

It prevents XSS attacks, data injection and clickjacking by restricting scripts, styles, images, fonts and other resources to trusted sources. This tool lets you build CSP headers visually instead of writing the complex syntax by hand.

CSP Header Generator showing a worked example — Build Content-Security-Policy headers visually. Configure directives with presets and copy the header.
CSP Header Generator with the built-in example loaded. Free, no sign-up, and the result appears as you type.
Step by step

How to use CSP Header Generator

  1. 1

    Start with a preset

    Choose Strict, Moderate or Permissive as a starting point based on your security needs.

  2. 2

    Configure directives

    Toggle source values for each directive. Add custom domains where needed.

  3. 3

    Test with Report-Only

    Enable Report-Only mode to test your policy without breaking your site.

  4. 4

    Copy and deploy

    Copy the generated header and add it to your server configuration.

What's inside

Everything this tool
does for you

  • 13 CSP directives with visual toggles
  • 3 security presets (Strict, Moderate, Permissive)
  • Custom domain allowlisting per directive
  • Report-Only mode for safe testing
  • Apache, Nginx and meta tag output
  • Real-time header preview
Keep going

Related free tools

All Security & Network tools
Questions

Frequently asked questions

Beyond this tool

See the full picture for your website.

Enter your URL for a free audit across eight scored areas. See prioritised issues and clear next steps in one report.

Run a free website audit

Free to start · No signup required