How to use the CSP Header Generator
1. Toggle the directives you need and edit their source lists.
2. Common values: 'self' (same origin), 'none' (block all), 'unsafe-inline' (inline scripts/styles), https: (any HTTPS source).
3. Copy the generated header value, Nginx config, Apache config, or HTML meta tag.
What is it?
Content Security Policy (CSP) is an HTTP response header that tells browsers which content sources are legitimate, preventing cross-site scripting (XSS) and data injection attacks. It's one of the most effective browser-enforced security mechanisms available.
Each directive controls a specific content type. Unset directives fall back to default-src. Using 'none' for object-src and frame-ancestors is recommended as a baseline.
Benefits
Know exactly who and what is visiting your app
User agent parsing reveals browser name, version, operating system, device type, and whether a request comes from a real user or a bot — essential for analytics, feature flags, and traffic analysis.
Convert curl commands to ready-to-use fetch code
Paste any curl command — from browser DevTools, documentation, or Stack Overflow — and get the equivalent JavaScript fetch API call, ready to drop into your application.
Catch server misconfiguration before users do
Inspect HTTP response headers for missing CORS policies, incorrect Content-Type values, broken cache directives, and absent security headers like CSP and HSTS.
Test API endpoints in the browser without Postman
Send GET, POST, PUT, and DELETE requests with custom headers, bodies, and query parameters directly in your browser — no installation, no account, no context switching.
Frequently asked questions
What does 'self' mean?
'self' means the same origin as the page (same protocol, host, and port). Scripts/styles must come from the same server.
Can I use a meta tag instead of an HTTP header?
Yes — the meta tag equivalent is shown below. However, HTTP headers are preferred because they protect against HTML injection in the document head.
What is report-uri?
report-uri specifies a URL where the browser sends JSON reports when a CSP violation occurs. Use it to monitor violations before enforcing strict policies.