CSP Policy Builder
Choose content sources and produce a Content-Security-Policy draft and explanation, without claiming the copy is sufficient security.
Start from a preset, then tick what your site needs.
More directives
Your result
Tick at least one source to build the policy.
How to use it
- Type the fallback, the script source, and the image source.
- Read the policy.
- Read the draft line.
Examples
- Self, none, and one hostself, none, https://smart.example default-src 'self'; script-src 'none'; img-src https://smart.example; object-src 'none' draft: not a security guarantee
- All selfself, self, self default-src 'self'; script-src 'self'; img-src 'self'; object-src 'none' draft: not a security guarantee
- Nonenone, none, none default-src 'none'; script-src 'none'; img-src 'none'; object-src 'none' draft: not a security guarantee
Tool details and privacy
Type self, none, or an https host for the fallback, scripts, and images. The page writes the policy and says it is a draft.
A policy line can be copied. It does not prove the site is safe.
Options
- Each source is self, none, or https://host.
- object-src 'none' is always added.
Limits
- This is a draft, not a security guarantee.
- http hosts are refused.
- Wildcards are not offered.
Privacy
What you type stays in your browser. Nothing is uploaded or saved on the server.
Questions
Is this a security guarantee?
No. It is a draft.
Is object-src included?
Yes. It is 'none'.
Are http hosts accepted?
No.
Is the policy uploaded?
No.