Content Security Policy Builder & Checker
Build CSP response headers or inspect existing policies, with diagnostics for duplicate directives, broad sources and nonce/hash combinations.
Build a header you can review
Build starts with explicit source lists and allows extra directives, one per line. The result contains a normalized policy, complete response-header text and a parsed view. Report only changes the header name; you must configure your own server to send it. The tool does not apply your input to this site.
Analyze preserves duplicate directives and marks later occurrences as ignored: the first directive of the same name wins within one policy. Comma-separated policies remain separate and combine by intersection, not by allowing every source from every policy.
Read diagnostics in context
Checks cover source syntax, hash lengths, short nonces, unsafe-inline, unsafe-eval, broad wildcard/HTTP/data sources, none combined with other values, and strict-dynamic without a nonce or hash. Diagnostic codes identify the directive. Unknown future directives remain visible rather than being silently deleted.
This is a policy editor and partial checker, not a complete security audit. Generate a fresh unpredictable nonce for each response; do not copy a fixed example into production. strict-dynamic changes how compatible browsers treat host allowlists. Test real pages first, observe reports and then choose enforcement. The CSP3 reference is a working draft.
Reference
Questions & answers
Does Report-Only block scripts?
No. It reports violations when reporting is configured; an enforcing Content-Security-Policy header is needed to block.
Is the generated default policy ready for every site?
No. Inline code, fonts, frames, APIs and third-party resources differ. Review the actual resources and verify the policy in a browser.
Is my input uploaded?
No. Processing runs in your browser. Engines load from this site; the tool does not send input to a processing API or save it. Clear removes the visible input and result.