CSP & Security Headers Generator
A Content Security Policy (CSP) restricts which hosts may load scripts, styles, images and connections. Companion headers such as X-Frame-Options and Referrer-Policy close other browser-side gaps. Pick the directives you need, add third-party hosts, and copy the resulting header block.
What do these headers do?
CSP is the main defence against injected scripts (XSS). frame-ancestors / X-Frame-Options stop your pages being embedded in clickjacking frames. upgrade-insecure-requests rewrites http subresources to https. Referrer-Policy limits how much URL data leaks to other sites.
Deploy a new policy in report-only mode first so violations are logged without breaking the page.
This tool runs entirely in your browser. Your inputs and files are processed locally and are never sent to or stored on Kinetikatech servers.
Related pages
Server problem? Hacked site? Slow website?
Critical issues answered within 30 minutes, 24 hours a day, 7 days a week.