Free CSP Generator
Build a Content Security Policy header visually
Configure each CSP directive using dropdowns, then generate a production-ready Content-Security-Policy header with copy-paste code for Nginx, Apache, and HTML meta tags.
Trusted by teams at
How it works
How CSP Generator works
Configure each directive
Select a value for each CSP directive using the dropdowns. Each directive controls which sources are allowed for a specific content type like scripts, styles, images, or frames.
Generate the header
Your selections are compiled into a valid Content-Security-Policy header string that you can copy directly into your server configuration, meta tag, or CDN settings.
Copy implementation code
Get ready-to-paste code snippets for Nginx, Apache, and HTML meta tags. Any unsafe directives are flagged with quick notes on how to tighten them.
Features
What CSP Generator checks
Visual directive builder
Configure nine key CSP directives through a simple interface instead of manually writing complex header strings. Reduces syntax errors and misconfiguration.
Detect unsafe-inline and unsafe-eval risks
Flags directives that use 'unsafe-inline' or 'unsafe-eval', which effectively disable CSP's XSS protection for those content types. Suggests nonce-based or hash-based alternatives.
Generate copy-paste header values
Produces a complete, properly formatted Content-Security-Policy header value ready for your Nginx, Apache, Cloudflare, or application-level configuration.
Flag unsafe directives
Warns about 'unsafe-inline', 'unsafe-eval', and wildcard sources that weaken XSS protection, with one-line fixes for each.
Multiple server formats
Get implementation code for Nginx (add_header), Apache (.htaccess), and HTML meta tags so you can deploy to any environment.
Use cases
Who should use the free CSP Generator
Web Developers
Build a Content Security Policy for your application from scratch without memorizing directive syntax. Start with a strict baseline and loosen only what's needed.
DevOps Engineers
Generate CSP headers for server configurations, CDN edge rules, or reverse proxy setups. Ensure consistent security policies across all environments.
Security Teams
Evaluate and improve existing CSP policies. Identify overly permissive directives that weaken your XSS protection and generate tighter replacements.
More tools
All free security tools
Scanners
(10)Checkers
(7)Decoders & Generators
(2)FAQ
Frequently asked questions
Everything you need to know about the free CSP Generator.
Go beyond CSP Generator
This free CSP Generator checks a handful of things. Maced's AI pentest checks thousands.
Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.
Proof of exploit on every finding · SOC 2 & ISO 27001 compatible