Security
Processed locally in your browser — not uploaded
Content Security Policy (CSP) Generator & Linter
Configure Content Security Policy (CSP) directives and audit rules against OWASP XSS benchmarks. Calculates a 0–100 Security Rating, flags dangerous unsafe-inline/unsafe-eval bypass risks, and generates HTTP response headers, <meta> tags, and Nginx directives. Runs entirely in your browser.
CSP Security Health Score:90/100 (Grade: A)
Configure CSP Directives
default-src
script-src
style-src
img-src
connect-src
font-src
frame-ancestors
Generated Rule Output
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' https: data:; connect-src 'self' https:; font-src 'self' data: fonts.gstatic.com; frame-ancestors 'none';
Security Benchmark Warnings (1)
⚠️ `style-src 'unsafe-inline'` permits inline CSS injection.
01
How to use
- Configure directives for default-src, script-src, style-src, img-src, connect-src, font-src, and frame-ancestors.
- Toggle allowed origins ('self', 'unsafe-inline', 'unsafe-eval', https:, data:, or custom CDN domains).
- Review your calculated Security Rating (0–100 score).
- Select output format tab (HTTP Response Header, HTML Meta Tag, or Nginx config directive).
- Copy ready-to-use Content Security Policy rules into your server configuration.
02
Understanding the output
Content Security Policy (CSP) restricts resource loading (JS, CSS, images, frames) to trusted origin domains, mitigating Cross-Site Scripting (XSS) and data injection attacks.
03
Common issues & tips
- •Using `'unsafe-inline'` or `'unsafe-eval'` in `script-src` disables XSS protections against injected script payloads.
- •Setting `frame-ancestors 'none'` prevents clickjacking attacks by blocking iframe embedding.
Frequently asked questions
- Why does script-src unsafe-inline trigger a security warning?
- Allowing unsafe-inline scripts enables cross-site scripting (XSS) payloads to execute inside user browser sessions.