Header Prism

HTTP header & security policy tools

02Content-Security-PolicyGenerator

CSP generator

Tick the sources each resource type may load from, add hosts, hashes or a nonce, and copy the policy as a header, a meta tag or server configuration.

A

Directives

checked = allowed
  • default-srcFallback for every fetch directive you do not set.
  • script-srcWhere scripts may load from and which inline scripts may run.
  • style-srcStylesheets, <style> blocks and style= attributes.
  • img-srcImages and favicons.
  • font-srcWeb fonts loaded with @font-face.
  • connect-srcfetch(), XMLHttpRequest, WebSocket, EventSource and sendBeacon targets.
  • media-src<audio>, <video> and <track> sources.
  • object-src<object> and <embed> plugins. Set it to 'none'.
  • frame-srcPages this page may embed in <iframe>.
  • worker-srcWorker, SharedWorker and service worker scripts.
  • manifest-srcThe web app manifest.
  • base-uriAllowed URLs for <base href>. No fallback to default-src.
  • form-actionWhere forms may submit. No fallback to default-src.
  • frame-ancestorsWho may embed this page in a frame (clickjacking). No fallback.

Other directives

B

Hash & nonce helper

WebCrypto

Whitespace and line breaks count. Pasting the whole <script>…</script> element is fine: the tags are removed and the inside is hashed.

—

A nonce must be generated by your server, fresh for every response, and added to each <script nonce="…">. A fixed nonce copied into a config file protects nothing.

C

Start from an existing policy

D

Your policy

–

						

						

					

					

						
Quick check

						
  • …Checking the policy.

						
Full breakdown in the CSP evaluator

					

				

			

		

	


	

		

			
How to build a policy that does not break your site

			
Start from Baseline: everything comes from your own origin, plugins are off and nobody can frame the page. Then add what your pages really load: a CDN host under script-src, an analytics endpoint under connect-src, data: under img-src for inline images.

			
    
				
  • Fallbacks: any fetch directive you leave empty falls back to default-src. base-uri, form-action and frame-ancestors do not, which is why they have their own rows.
    • 
				
  • Inline code: rather than 'unsafe-inline', hash each inline script with the helper, or use a per-response nonce with 'strict-dynamic' (the Strict preset).
    • 
				
  • Meta tag: frame-ancestors, report-uri and sandbox are ignored in a <meta> policy, so the meta output leaves them out.
    • 
			

			
Roll it out with Report-only first, watch the reports for a few days, then enforce. Check the result with the CSP evaluator, or send the rest of your headers with the security headers generator.

		

	


	

		
FAQ
CSP generator questions

		

			

				Should I use hashes or a nonce?
				
Hashes suit static pages whose inline scripts never change: the hash goes in the policy once. Nonces suit server-rendered pages: the server creates a random value for every response and puts it on each script tag and in the header.

			

			

				Why does my hash not match?
				
The hash covers the exact characters between the tags, including spaces and line breaks. Template engines and minifiers often change whitespace, so hash the HTML your server finally sends.

			

			

				What does 'strict-dynamic' do?
				
It lets a script you trusted by nonce or hash load further scripts. Modern browsers then ignore host lists, 'self' and 'unsafe-inline' in script-src; those stay as a fallback for older browsers.