CSP Generator

What is Content Security Policy (CSP)?

Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. By specifying which content sources are legitimate, CSP instructs browsers to only execute or render resources from those approved sources.

CSP acts as a whitelist mechanism—if a resource isn't explicitly allowed by your policy, the browser blocks it. This provides a powerful defense-in-depth layer even if an attacker manages to inject malicious code into your pages.

Understanding CSP Directives

CSP Source Values

CSP Implementation Strategies

1. Start with Report-Only Mode

Use Content-Security-Policy-Report-Only header to test your policy without breaking your site:

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-reports

This logs violations without blocking them, helping you refine your policy.

2. Use Nonces for Inline Scripts

Instead of 'unsafe-inline', generate a random nonce for each request:

<script nonce="random123">...</script>
Content-Security-Policy: script-src 'nonce-random123'

3. Use Hashes for Static Inline Scripts

Calculate the SHA-256 hash of your inline script content:

Content-Security-Policy: script-src 'sha256-abc123...'

Common CSP Configurations

Strict CSP (Recommended)

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'strict-dynamic' 'nonce-{random}';
  style-src 'self';
  img-src 'self' data: https:;
  font-src 'self';
  object-src 'none';
  base-uri 'self';
  frame-ancestors 'none';

CSP for Sites with Google Analytics

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com;
  img-src 'self' https://www.google-analytics.com;
  connect-src 'self' https://www.google-analytics.com;

CSP for Sites with CDN Resources

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com;
  style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline';
  font-src 'self' https://fonts.gstatic.com;

CSP and Third-Party Services

Adding third-party services requires updating your CSP. Here are common additions:

• Google Fonts: font-src https://fonts.gstatic.com; style-src https://fonts.googleapis.com
• YouTube embeds: frame-src https://www.youtube.com
• Stripe: script-src https://js.stripe.com; frame-src https://js.stripe.com
• reCAPTCHA: script-src https://www.google.com https://www.gstatic.com; frame-src https://www.google.com