How do I use the content Security Policy generator?
- Tick the services your site loads.
- Choose whether to allow inline styles and start in report-only mode.
- Copy the header into your server or framework config.
Content Security Policy generator: frequently asked questions
What is a Content Security Policy?
A response header that tells browsers which sources of scripts, styles, images and frames your page may load, which limits the damage of cross-site scripting.
Should I start in report-only mode?
Yes. Report-only logs violations without blocking, so you can fix the policy before enforcing it.
Why does Google Tag Manager need extra rules?
GTM loads other scripts and can inject inline code. You may need nonces or hashes for custom HTML tags.
Is unsafe-inline dangerous?
For scripts, yes — avoid it. For styles it is a lower risk and often needed by frameworks.
How do I check my current headers?
Use our HTTP headers checker.
Does CSP affect SEO?
Not directly, but a broken policy can stop analytics or page features from working.
Is there an API for this tool?
Selected tools are available through a rate-limited public API. Contact us if you need higher volumes.
Is the content security policy generator free?
Yes. It is free with no sign-up and no usage limits for normal use.
Is my data sent to your servers?
No. This tool runs entirely in your browser, so what you type never leaves your device.
Does it work on my phone?
Yes. The tool works in any modern browser on iPhone, Android, tablet or computer.