Agent X Alpha

CSP Generator

Client-SideOffline Ready

Build Content Security Policy headers visually with toggleable directives and sources.

1-Click Policy Presets:
Directive Rules & Sources
default-src

Fallback security perimeter for unstated directives

script-src

Valid executable JavaScript origins

style-src

Valid CSS stylesheets & typography origins

img-src

Permitted image and favicon sources

font-src

Web fonts loaded via @font-face

connect-src

Fetch, XMLHttpRequest, WebSocket, and Beacon endpoints

media-src

Audio and video stream origins (<audio>, <video>)

object-src

Plugins (<object>, <embed>, <applet>) - Recommend 'none'

frame-src

Valid child iframe and embed destinations

worker-src

Web Worker, SharedWorker, and ServiceWorker scripts

manifest-src

PWA web application manifest origins

base-uri

Restricts URLs that can appear in a document's <base> element

form-action

Restricts valid endpoints for form submissions

frame-ancestors

Clickjacking defense: Who can embed this page via iframe

upgrade-insecure-requests

Instructs browsers to treat all HTTP URLs as HTTPS

block-all-mixed-content

Prevents loading any HTTP content over HTTPS

Generated Policy

Security Risk Assessment

Zero High-Risk Vectors: Clean, secure policy definition!

Cross-Site Scripting (XSS) Defense

Content Security Policy (CSP) restricts executable script origins, mitigating reflected, stored, and DOM-based XSS attacks.

Multi-Platform Server Configs

Generate ready-to-deploy code snippets for Next.js App Router, Nginx, Apache .htaccess, and Cloudflare Workers.

Live Vulnerability Audit

Inspect dangerous directives in real time, alerting you to unsafe-inline and unsafe-eval vectors before pushing to production.

Frequently Asked Questions

What is a Content Security Policy (CSP)?
A Content Security Policy (CSP) is an HTTP response header that restricts the resources (scripts, styles, images, iframes, fonts) a browser is allowed to load for a given page, acting as a primary defense against Cross-Site Scripting (XSS) and data injection attacks.
How do I add the generated policy to my web application?
You can deliver it as an HTTP header from your reverse proxy or web server (e.g. Nginx, Apache, Cloudflare Workers, Caddy) via "Content-Security-Policy: <your-policy>", or inside an HTML document using <meta http-equiv="Content-Security-Policy" content="...">.
What is the difference between default-src and script-src?
default-src serves as the fallback for all directive types not explicitly defined. Specifying directives like script-src, style-src, or img-src overrides default-src for those specific resource categories.
Does this CSP Generator run client-side?
Yes. All policy rule generation and live preview formatting take place entirely in your browser memory without transmitting your domain or configuration to any server.
Recommended For You

More Security & Privacy Utilities

View all Security & Privacy tools
Security & Privacy

DMARC, SPF & DKIM Email Security Auditor & Generator

Audit live DMARC, SPF, DKIM, and BIMI DNS records. Detect 10-lookup SPF limit violations, spoofing vulnerabilities, and generate copy-paste DNS records and 2048-bit DKIM keys.

Network APILaunch
Security & Privacy

TOTP / 2FA Authenticator Simulator

Simulate, generate, and verify RFC 6238 Time-based One-Time Passwords with interactive countdowns, URI import, SHA-1/256/512 algorithms, and clock drift testing.

Client-SideLaunch
Security & Privacy

PII & Secret Log Redactor / Masker

Scrub credentials, API keys, passwords, credit cards, emails, and PII from production logs and error stack traces 100% locally in your browser before sharing.

Client-SideLaunch