What's the difference between the header and meta tag?

The HTTP header is set by your server and is recommended. The meta tag works for static sites without server config — but some directives (like frame-ancestors) only work in the header.

What does 'self' mean?

Same-origin — only resources from the current site are allowed. Always start with default-src 'self'.

Why is unsafe-inline bad?

It allows inline scripts and styles, which weakens CSP's XSS protection. Move inline scripts to external files where possible.

Is my policy uploaded?

No. The header is built locally.

CSP Builder

New

Build a Content-Security-Policy header with a clean UI.

100% private — no uploads Developer ToolsFree & unlimited Read tutorial

See how it works

Watch a quick simulation of this tool in action — no file needed.

How to use CSP Builder

Follow these steps — everything happens instantly in your browser.

1
Step 1. Add or edit directives — default-src, script-src, style-src and more.
2
Step 2. Toggle upgrade-insecure-requests and (optionally) report-uri.
3
Step 3. Copy either the HTTP header or the meta tag version.

Why use this tool

Frequently asked questions

Everything you might want to know about csp builder.

Related tools

New

HTTP Headers Decoder

Parse and annotate raw HTTP headers — 60+ known headers.

Open

New

.htaccess Generator

Build Apache .htaccess rules — HTTPS, redirects, caching, more.

Open

New

nginx Config Generator

Generate nginx server blocks — static, SPA, proxy, PHP-FPM, HTTPS.

Open

Trending

Hash Generator

Compute SHA-1, SHA-256 and SHA-512 hashes — locally.

Open