Content Security Policy Generator

Cross-Site Scripting (XSS) has been on the OWASP Top 10 since the list was created. Despite years of awareness, XSS remains one of the most common web vulnerabilities. Content Security Policy (CSP) is the most effective defense against XSS because it stops the attack at the browser level, even if your code has an injection vulnerability. A CSP header tells the browser which sources are allowed to load scripts, styles, images, and other resources. This generator lets you configure CSP directives visually and outputs the policy as an HTTP header, meta tag, or raw string.

The generator collects your input for each CSP directive and assembles them into a semicolon-separated policy string. Each directive follows the format `directive-name source1 source2 source3`. Empty directives are omitted from the output. The output format selector wraps the policy string in the appropriate container: an HTTP header line (`Content-Security-Policy: ...`), an HTML meta tag (``), or the raw policy string. The tool does not validate your policy against the CSP specification; it only assembles the directives you configure.

Content Security Policy was introduced by Mozilla in Firefox 4 (2011) and standardized by the W3C. The current version is CSP Level 3, published in 2024, though most browsers implement a mix of Level 2 and Level 3 features.

How CSP prevents XSS:

Without CSP, a browser will execute any JavaScript that appears in the page, regardless of where it came from. If an attacker injects a `