Interactively build a Content-Security-Policy header. Choose directives, add sources, get real-time grading and security tips.
Fallback for other fetch directives. Start strict, then relax specific directives.
Controls which scripts can execute. Critical for XSS prevention.
Controls which stylesheets can be applied.
Controls which images can be loaded.
Controls which fonts can be loaded.
Controls fetch, XHR, WebSocket, and EventSource connections.
Controls audio and video sources.
Controls plugins (Flash, Java). Should be 'none' on modern sites.
Controls which URLs can be loaded in iframes.
Controls web workers and nested browsing contexts.
Controls Worker, SharedWorker, and ServiceWorker scripts.
Controls which manifests can be loaded.
Controls who can embed this page. Replaces X-Frame-Options.
Controls where forms can submit. Prevents form hijacking.
Restricts URLs for <base> element. Prevents base tag injection.
Restricts URLs the document can navigate to.
Recommendations
No directives configured
Content-Security-Policy (CSP) is an HTTP response header that helps prevent Cross-Site Scripting (XSS), clickjacking, and other code injection attacks. It works by specifying which content sources the browser should trust, effectively creating an allowlist of trusted origins for scripts, styles, images, and more.