Code / FREE ONLINE TOOL
CSP & Security Headers Generator
Build a Content-Security-Policy and HTTP security headers online: HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin policies, for Apache, Nginx, PHP and IIS.
Content-Security-Policy
Sources are separated by spaces: 'self', 'none', https://cdn.example.com, *.example.com, data:, 'nonce-…', 'sha256-…'. Keywords are quoted automatically.
Other security headers
Import an existing policy
QUICK GUIDE
How to use this tool
Start from a preset, edit the sources of each directive and choose the server format. The checks point out weak spots such as inline scripts. Deploy a new policy in Report only mode first and enforce it when nothing you need is blocked. Import shows how an existing policy can be improved.
Your input is processed locally. Use Copy or Download to keep your result.
Keep your workflow moving
Need another step? Try a related tool.