Loading tool...
Generate Subresource Integrity (SRI) hashes for scripts and stylesheets. Protect against CDN compromise and tampering
Complete HTTP status code reference with descriptions. Search all 1xx, 2xx, 3xx, 4xx, and 5xx status codes with explanations
Decode and analyze PEM-encoded X.509 SSL/TLS certificates. View subject, issuer, validity, extensions, and fingerprints
Content Security Policy headers are powerful but notoriously tricky to get right. One wrong directive and your site breaks; one missing directive and you're open to XSS. This visual builder lets you construct a CSP directive by directive, test it against your use cases, and export the finished header.
CSP works by whitelisting which sources can provide scripts, styles, images, fonts, frames, and other resources. Each directive (script-src, style-src, img-src, etc.) controls a specific resource type. This builder walks you through each directive, explains what it controls, and lets you add sources like 'self', specific domains, 'nonce-…', and 'unsafe-inline' with clear warnings about the security implications of each choice.
Build a strict CSP that blocks inline scripts and unauthorized resource loading to prevent XSS attacks.
Start with report-only mode to identify violations before enforcing the policy.
Configure frame-src and script-src to allow specific embedded widgets while blocking everything else.
Generate CSP headers that satisfy security standards like PCI DSS or SOC 2.
Help team members understand what each CSP directive does using the inline documentation.
Set default-src to 'self', add your CDN domain to script-src and style-src, and block everything else.
Add *.google-analytics.com and *.googletagmanager.com to script-src and connect-src.
It allows inline <script> and <style> tags to execute, which largely defeats the purpose of CSP since injected scripts would also run. Use nonces or hashes instead.
Content-Security-Policy-Report-Only logs violations without blocking anything, letting you test a policy in production before enforcing it.
Generate a unique nonce per page load, add it to both the CSP header ('nonce-abc123') and the script tag (nonce="abc123"). Each page load needs a fresh nonce.
Likely, if you start strict. Use report-only mode first to identify what your site loads and from where, then build the allow list accordingly.
All processing happens directly in your browser. Your files never leave your device and are never uploaded to any server.