Content Security Policy Builder & Analyzer
Build and statically analyze Content Security Policy headers with explicit diagnostics and a strict CSP starter.
Report-Only observes violations but does not enforce the policy.
Policy directives
Header and readable policy
Builder: leave a field empty to omit it; use quoted 'none' to deny a resource. Enter space-separated sources. Analyzer: paste one header or policy. Normalization keeps source order/case and the first duplicate directive; it does not silently repair permissions.
A nonce must be generated securely and uniquely for each HTTP response. Replace {RANDOM_PER_RESPONSE} on the server and matching authorized elements; never deploy a fixed reusable nonce. The starter needs application-specific testing.
Static CSP analysis can identify common weaknesses and configuration issues, but it cannot prove that a website is secure or that a policy is compatible with every application feature.
Build a policy, then review its effects.
Use structured source fields or paste a single Content-Security-Policy header in Analyzer. Sources are separated by spaces and directives by semicolons. Directive names are normalized to lowercase; source case is preserved. Browser semantics keep the first duplicate directive. Unknown directives remain visible and are preserved without semantic validation. Errors withhold the copy-ready header; warnings require review, not automatic fixes.
Different directives protect different boundaries.
default-src is a fallback for fetch directives. frame-src controls frames loaded by this page; frame-ancestors controls who may frame the page and does not inherit default-src. base-uri and form-action also need explicit review. A restrictive object-src prevents object/embed content. Script element policies can override script-src. The analyzer reports broad script permissions, unsafe-inline/eval, wildcards, HTTP sources, missing protections and malformed source expressions.
A strict starter is not a deployable nonce.
The Strict CSP Starter uses a conspicuous nonce placeholder, strict-dynamic, restrictive default-src, object-src and base-uri. Generate a fresh secure nonce for every response and match it on authorized scripts. Never reuse the placeholder or a fixed nonce in production. Hash authorization must match actual script/style bytes. Runtime nonce randomness, application compatibility and browser behavior cannot be proven here. No framework-specific policy is promised.
Static analysis and deployment limits.
Report-Only observes violations but does not enforce the policy. Configure reporting separately and consider what violation reports disclose. The tool never fetches sources, executes scripts or sends reports. It accepts one ASCII policy up to 8,192 characters, 64 directives and 64 sources per directive, each at most 1,024 characters. Multiple policies, meta-tag delivery, full browser matching, historical directive semantics and automatic nonce generation are outside scope. The readable multi-line view is documentation; copy uses the single-line HTTP header.
Static CSP analysis can identify common weaknesses and configuration issues, but it cannot prove that a website is secure or that a policy is compatible with every application feature. Strong baseline describes only the reviewed static checks, never a security guarantee.