Advertisement
Guide
About the Content-Security-Policy Generator
A Content-Security-Policy is an HTTP response header that tells the browser where a page may load scripts, styles, images, fonts and frames from. If an attacker manages to inject a <script> tag, a good policy stops the browser from running it.
Start from a preset, tick the third-party services you use, and adjust each directive. The generator merges and de-duplicates sources and points out settings that weaken the policy.
Why unsafe-inline defeats the purpose
Most XSS attacks inject inline script. Allowing 'unsafe-inline' in script-src lets that script run, so the policy then mostly guards against loading files from other hosts. Move inline code into files, or give each legitimate inline script a per-request nonce.
Nonces and strict-dynamic
With a nonce, the server puts a fresh random value in the header and on each trusted <script nonce="…">. Adding 'strict-dynamic' lets those trusted scripts load further scripts, such as a tag manager loading its tags, without listing every host. This is the approach Google recommends for new sites.
How to use it
- 1Pick a preset or import your current policy.
- 2Tick the third-party services your site uses.
- 3Fine-tune each directive’s sources.
- 4Deploy in report-only mode, fix violations, then enforce.
Frequently asked questions
What is the difference between default-src and script-src?
default-src is the fallback for every fetch directive you do not set. Once you set script-src, it replaces default-src for scripts entirely, so repeat 'self' there if you still need it.
Header or meta tag?
Use the header when you can. The meta tag works on static hosts without header control, but it cannot set frame-ancestors, reporting or report-only mode, and it does not cover anything loaded before the tag.
How do I test a CSP without breaking my site?
Send it as Content-Security-Policy-Report-Only. Browsers log every violation in the console but block nothing. Once the console is clean, switch to the enforcing header.
Why is Google Analytics blocked by my CSP?
It loads script from googletagmanager.com and sends data to several google-analytics.com hosts. Tick Google Analytics / Tag Manager to add them to script-src, img-src and connect-src.
Does frame-ancestors replace X-Frame-Options?
Yes. frame-ancestors 'none' equals DENY and 'self' equals SAMEORIGIN, and modern browsers prefer it. Keep X-Frame-Options only for very old browsers.
Do I need a CSP if my framework escapes output?
Escaping is the main defence; CSP is a second layer for the bug you did not catch, such as a dangerouslySetInnerHTML or a compromised third-party script.