CSP builder

Build or tighten a Content-Security-Policy and copy it for nginx, Apache or a meta tag.

Paste an existing policy to audit it (optional)

Presets:

Options upgrade-insecure-requests Report-only (test without blocking)

Output

Tips for a strong CSP

Start with default-src 'self' and add only the hosts you really load from.
Use nonces or hashes instead of 'unsafe-inline' for scripts; 'strict-dynamic' lets trusted scripts load their dependencies.
Always set object-src 'none', base-uri 'self' and frame-ancestors.
Roll out with Report-only first, then enforce. Check the result with the security headers checker.