CSP Builder
A Content Security Policy (CSP) is an HTTP header that tells the browser which sources may load scripts, styles, images and frames — the main defence against cross-site scripting (XSS). Toggle the directives here to assemble a header and catch unsafe choices before deploying.
What is a CSP?
A CSP is a list of directives sent with the page. default-src is the fallback; script-src, style-src and img-src restrict each resource type. 'unsafe-inline' re-allows inline scripts and undoes much of the protection, and a bare * lets any host load code.
Start from default-src 'self' and widen only where a real integration needs it. Ship in report-only mode first, fix what it logs, then enforce.
This tool runs entirely in your browser. Your inputs and files are processed locally and are never sent to or stored on Kinetikatech servers.
Related pages
Server problem? Hacked site? Slow website?
Critical issues answered within 30 minutes, 24 hours a day, 7 days a week.