CSP Generator
Build a Content-Security-Policy header step by step. Start from a strict, nonce-based policy, add the hosts your pages need, and copy the header with Nginx, Apache and meta tag snippets.
Start a check
- Runs in your browser
- Graded as you build
Build
Choose your policy
Every change updates the header, the snippets and the grade.
Result
Your Content-Security-Policy
Replace {RANDOM} on every response
Generate at least 16 random bytes per response, base64-encode them, and use the same value in the header and in the nonce attribute of each script tag. A static server configuration cannot do this; your application has to.
HTTP response header
Content-Security-Policy: default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'" always;Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'"HTML meta tag
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; form-action 'self'">The meta tag leaves out frame-ancestors, report-uri and report-to, which browsers ignore in a meta tag.
Grade
How the CSP evaluator grades it
A+
STRONGSTRICT CSP
100/100
No findings: the policy matches every check.
Starting points
Introducing Vigilbase OS
The cybersecurity operating system.
Connect the security tools you already pay for. Spin up personalised dashboards in minutes, with every log and event auditable and queryable in one place.
one.vigilbase.com/acme.examplePreview · sample data
Acme Security OS
events | where severity >= medium | last 24hVigil agentWorking
- Investigate Credential-stuffing burst against /login
- Fix Rate-limit rule deployed at the edge
- Verify Attack traffic down 98% in five minutes
What is a CSP generator?
A CSP generator assembles a Content-Security-Policy header from your answers about where pages load scripts, styles, images and frames from. This one starts from the strict CSP that the CSP Level 3 specification describes (scripts allowed by nonce or hash with 'strict-dynamic', object-src 'none' and base-uri 'none') and grades the result with the same rules as the CSP evaluator.
Deploy a new policy as Content-Security-Policy-Report-Only first, read the reports, fix what they show, then enforce it.
How to deploy a Content-Security-Policy
A policy protects only once browsers enforce it, and it can break pages that load something it does not allow. Roll it out in this order.
1. Choose how scripts are trusted
Nonces suit pages generated per request: your application adds a fresh random value to the header and to every script tag. Hashes suit static pages whose inline scripts never change. A host allowlist is the weakest option.
2. Add the hosts your pages need
List the image, font, API and frame hosts your pages use. With 'strict-dynamic', scripts that a trusted script loads need no host entry.
3. Start in Report-Only
Send the policy as Content-Security-Policy-Report-Only with a report endpoint, fix what it reports, then switch to Content-Security-Policy.
4. Send it as a response header
A meta tag cannot carry frame-ancestors, report-uri, report-to or sandbox, and cannot deliver a Report-Only policy. On Cloudflare, a response header transform rule can set a hash- or allowlist-based header for a zone; a nonce has to be generated for each response by your application.
Related checks and next steps
- CSP Evaluator
Paste an existing policy or fetch one from a URL and grade it.
- HTTP Security Headers Checker
Check that the header you deployed is live, with nine other security headers.
- HSTS Checker
Check Strict-Transport-Security and HSTS preload eligibility.
- Cloudflare WAF
How Cloudflare WAF rules work, and how Vigilbase sets them up and tunes them under change control.
Managed Cloudflare
Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.
Explore Managed CloudflareManaged SOC
Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.
Explore Managed SOCSources
Questions
CSP generator FAQ
Should I use a nonce or a hash?
Use a nonce when pages are generated per request, because your application can add a new random value to the header and to each script tag. Use hashes when pages are static and their inline scripts do not change: any edit to a script changes its hash.A practical website protection guide
What does 'strict-dynamic' do?
It lets scripts loaded by a trusted (nonced or hashed) script run too, without listing their hosts. Browsers that support it ignore host and scheme sources, 'self' and 'unsafe-inline' for scripts, so https: and 'unsafe-inline' can stay in the policy as fallbacks for old browsers.
How do I generate a CSP nonce?
For every response, create at least 16 random bytes with a cryptographically secure random number generator and base64-encode them. Put the value in the header as 'nonce-VALUE' and in the nonce attribute of each script tag. Never reuse a nonce or build it from predictable data.
Can I put the policy in a meta tag?
Only partly. A meta tag cannot carry frame-ancestors, report-uri, report-to or sandbox, cannot deliver a Report-Only policy, and does not apply to content that comes before it in the page. The meta tag snippet leaves those directives out.
Will the policy break my site?
It can, which is why the generator offers Report-Only. Browsers then report what the policy would block without blocking it. Fix the reported sources, then switch the header to Content-Security-Policy.HTTP Security Headers Checker
Is anything I enter stored?
No. The generator runs in your browser, and nothing you enter is sent to Vigilbase.Privacy and data handling