Build a Content-Security-Policy visually from presets, analyze an existing policy for XSS bypasses and missing directives, and generate script hashes and nonces. Outputs ready-to-paste config for Nginx, Apache, Caddy, Express, Netlify, Vercel, and more.
Start from a preset
Directives
A 100/100
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
221 characters ยท
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
Analysis
- info report-to No reporting configured; violations will not be collected.