Skip to main content
SlapMyWeb
Slap a site
Skip to tool
Security & Network

CSP Header Generator

Build Content-Security-Policy headers visually with presets and per-directive controls

  • 100% free
  • No sign-up
  • No limits
  • Instant results
default-src

Fallback for all fetch directives

script-src

Valid sources for JavaScript

style-src

Valid sources for stylesheets

img-src

Valid sources for images

font-src

Valid sources for fonts

connect-src

Valid targets for fetch/XHR/WebSocket

media-src

Valid sources for audio/video

frame-src

Valid sources for iframes

object-src

Valid sources for plugins (Flash, etc.)

base-uri

Valid URLs for <base> element

form-action

Valid targets for form submissions

frame-ancestors

Who can embed this page (clickjacking protection)

upgrade-insecure-requests

Auto-upgrade HTTP to HTTPS

Generated Header
Content-Security-Policy: default-src 'self'
What this tool does
  • Visual per-directive configuration
  • 3 security presets (Strict, Moderate, Permissive)
  • Custom domain allowlisting
  • Report-Only mode toggle
Want the whole picture? Run 240+ checks on your site — free, 30 seconds, no signup.Run a free audit
The short version

What is CSP Header Generator?

A Content-Security-Policy (CSP) header tells browsers which resources are allowed to load on your page.

It prevents XSS attacks, data injection and clickjacking by restricting scripts, styles, images, fonts and other resources to trusted sources. This tool lets you build CSP headers visually instead of writing the complex syntax by hand.

Step by step

How to use CSP Header Generator

  1. 1

    Start with a preset

    Choose Strict, Moderate or Permissive as a starting point based on your security needs.

  2. 2

    Configure directives

    Toggle source values for each directive. Add custom domains where needed.

  3. 3

    Test with Report-Only

    Enable Report-Only mode to test your policy without breaking your site.

  4. 4

    Copy and deploy

    Copy the generated header and add it to your server configuration.

What's inside

Everything this tool
does for you

  • 13 CSP directives with visual toggles
  • 3 security presets (Strict, Moderate, Permissive)
  • Custom domain allowlisting per directive
  • Report-Only mode for safe testing
  • Apache, Nginx and meta tag output
  • Real-time header preview
Keep going

Related free tools

All Security & Network tools
Questions

Frequently asked questions

This tool fixed one thing.
Now fix the whole site.

Our scanner runs 240+ checks across 10 audit areas, ranks every issue by the score points it costs, and hands you the code to paste.

Run a free audit
240+ checksResults in 30sNo signup