CSP Header Generator

Assemble a Content-Security-Policy from sensible defaults, with a strict preset and a report-only mode.

default-src

script-src

style-src

img-src

font-src

connect-src

media-src

object-src

frame-src

frame-ancestors

base-uri

form-action

report-uri / report-to (optional)

Options

Add upgrade-insecure-requests

Emit Content-Security-Policy-Report-Only instead

Content-Security-Policy header

How it works

Directives left blank are omitted, and default-src is always emitted first so the policy is valid.
A strict preset locks everything to 'self'; a permissive preset allows common CDNs so you can tighten it from there.
Use report-only mode to test a policy in production without blocking anything.