How to use the Content Security Policy Generator
- 1. Set default-srcStart with 'self' so only your own domain is trusted.
- 2. Allow what you useAdd hosts for analytics, fonts, CDNs and embeds per directive.
- 3. Deploy safelyCopy the header, test in Report-Only mode, then enforce.
What CSP does
A Content Security Policy tells the browser which sources a page may load scripts, styles, images, fonts and frames from. If an attacker injects a script through an XSS bug, the browser refuses to run it because it does not come from an allowed source. It is one of the strongest defences against cross-site scripting.
With the defaults, the header starts Content-Security-Policy: default-src 'self', then allows Google Tag Manager scripts, Google Fonts styles and font files, images from your site, data: URLs and any HTTPS host, analytics connections, and sets object-src 'none', base-uri 'self', form-action 'self' and frame-ancestors 'self'.
Rolling it out without breaking your site
- Start in Report-Only mode. Nothing is blocked, but the browser console lists every violation.
- Add the sources you really need, and remove ones you do not.
- Replace inline scripts with files, or use nonces or hashes, so you can avoid
'unsafe-inline'. - Switch to the enforcing header once the console is clean.
- frame-ancestors stops other sites from framing yours (clickjacking). It is ignored in a meta tag, so send it as an HTTP header.
- object-src 'none' blocks old plugin content.
- upgrade-insecure-requests loads http:// resources over https://.
The generator checks each source's format and warns about risky choices, but it cannot know what your pages load; test on every template. The tool builds text only. Containerise the app that sends it with the Dockerfile generator, and revise the risks it addresses in the OWASP Top 10 cheat sheet.
Frequently asked questions
Will CSP slow down my site?
No. The browser checks sources as it loads them; the cost is negligible.
Does CSP replace input validation?
No. It limits damage if an XSS bug exists. You still need output encoding and validation.
Is the Content Security Policy Generator free?
Yes, the Content Security Policy Generator is free. The first time you generate your first policy, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.