The Tool Hive LogoThe Tool Hive

Tools

Network Tools

Text Tools

Data Tools

Design Tools

Development Tools

Code Tools

Security Tools

Utility Tools

About

Categories

  1. Home
  2. Tools
  3. Security Tools
  4. Csp Builder
The Tool Hive Logo

The Tool Hive

A comprehensive collection of free, browser-first tools for developers. Network requests only occur when a tool makes them explicit.

Tools

Text ToolsData ToolsDesign ToolsNetwork ToolsDevelopment Tools

Resources

AboutPrivacy PolicyTerms of Service

Contact Us

Having any issues? Wish to request a tool or feature? Contact us here.

Email Us

© 2026 The Tool Hive. All rights reserved.

PrivacyTermsCookies

Content-Security-Policy Builder

Assemble and validate a CSP directive by directive, with presets and a copyable header and meta tag.

Presets

Populate the whole policy, then tweak.

Emits the -Report-Only header (no blocking).

Directives

12 active

Fallback for most fetch directives when they are not set.

Keyword sources

Custom host sources

Valid sources for JavaScript and WebAssembly.

Keyword sources

Custom host sources

Valid sources for stylesheets.

Keyword sources

Custom host sources

Valid sources for images and favicons.

Keyword sources

Custom host sources

Restricts fetch, XHR, WebSocket and EventSource targets.

Keyword sources

Custom host sources

Valid sources for web fonts.

Keyword sources

Custom host sources

Valid sources for nested browsing contexts (iframes).

Keyword sources

Custom host sources

Valid sources for <audio>, <video> and <track>.

Keyword sources

Custom host sources

Sources for <object>/<embed>. Best set to ‘none’.

Keyword sources

Custom host sources

Restricts URLs usable in a document’s <base> element.

Keyword sources

Custom host sources

Restricts URLs that can be targets of form submissions.

Keyword sources

Custom host sources

Which parents may embed this page — anti-clickjacking.

Keyword sources

Custom host sources

Valid sources for Worker, SharedWorker and ServiceWorker.

Keyword sources

Custom host sources

Valid sources for the application manifest.

Keyword sources

Custom host sources

Validation notes

style-src includes 'unsafe-inline'. Common for legacy CSS, but weaker — consider hashes/nonces for styles.

HTTP response header

Content-Security-Policy
Content-Security-Policy: default-src 'self'; script-src 'self' https:; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; connect-src 'self' https:; font-src 'self' data:; frame-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'

HTML meta tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https:; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; connect-src 'self' https:; font-src 'self' data:; frame-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'">

Note: the meta-tag delivery ignores frame-ancestors, report-uri and Report-Only mode. Send those via the HTTP header instead.