How to use CSP
- 1. Fill directive sources. default-src, script-src, and friends.
- 2. Toggle upgrade-insecure-requests. Optional.
- 3. Copy CSP and Permissions-Policy. Paste into a server or _headers file.
- 4. Read COOP/COEP defaults. Cross-origin isolation is off unless you opt in.
About this tool
CSP is a allowlist for what a page may load. Permissions-Policy gates powerful APIs. COOP and COEP opt into cross-origin isolation. This tool writes the header values so you can paste them into nginx, Cloudflare Pages, or a meta tag experiment.
Report-only
Ship Content-Security-Policy-Report-Only first. This generator emits the enforcing name.
unsafe-inline
A style-src of 'unsafe-inline' is a common bootstrap, not a goal.
Code examples
Header
Content-Security-Policy: default-src 'self'