Free · without registration

Create and test Content Security Policy

Design a content security policy header or check specific resources against an existing policy. See which source rule applies and when additional browser context is required.

Preparing policy

Designing a CSP to suit your website

The specification allows own resources and limited embedded objects. Complete required sources separately for scripts, styles, images, fonts, connections, and frames. Enter only actually used services. A foreign domain in img-src does not yet allow scripts from the same domain. The generator does not change your server.

Start with Report-Only

The first draft uses Content Security Policy Report-Only. This allows you to check messages in the browser console without blocking resources. A central reporting endpoint is not established. After testing navigation, forms, login, and embedded services, you can deliberately create a blocking header. Inline scripts and styles require their own shares; a universal header for each website does not exist.

How the policy tester decides

Enter the protected page URL, resource type, and up to 50 sample URLs. The tester takes into account source lists, paths, protocols and directive fallbacks. Several enforcement policies work together: A release does not remove a lock from another policy. Report-only policies are displayed separately. The first directive of the same name within a policy applies.

Arrange nonce, hash and strict-dynamic correctly

For inline content, you can specify an existing nonce or hash source. A hit assumes that the value actually belongs to the element or content. Nonces must be created cryptographically randomly per server response. For external scripts with strict-dynamic, the loading script chain and integrity metadata can be crucial; then the tool reports an open context instead of a blanket release.

A source check is not a complete browser test

The tool simulates direct resource requirements according to the selected CSP source rules. CORS, redirects, sandbox, trusted types and other browser rules can also be blocked. Event handlers, eval and the entire ancestor chain of embedded pages are not simulated. The technical basis is the W3C CSP specification.

Example of classification

For default-src 'self'; img-src 'self' https://bilder.example.org;, an image from bilder.example.org is allowed. A script of the same domain remains locked without matching script-src sharing.

Frequent questions

Will a website be called for this?

No. Generator and tester work locally with your inputs. No header will be published automatically.

Why is context required displayed despite release?

Some decisions depend on Nonces, SRI or the loading script chain. A URL alone is not enough for these cases.

Can I check multiple CSP headers?

Yes. Add each complete Content Security Policy or Content Security Policy Report-Only header to a line of your own.