CSP & Security Header Builder

Compose a Content-Security-Policy + HSTS, X-Frame-Options & more — copy as nginx, Apache or a meta tag.

Free CSP generator: build a Content-Security-Policy header plus HSTS and X-Frame-Options, then copy as nginx, Apache or a meta tag. In-browser, nothing…

About CSP & Security Header Builder

CSP & Security Header Builder is a free, browser-based tool that composes a Content-Security-Policy plus other HTTP security headers — HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and a Permissions-Policy lockdown — then copies the result as raw headers, an nginx config, an Apache config, or a CSP <meta> tag. You build the CSP by ticking which sources (like 'self', 'none', https:, data:) each of 12 directives may load from, starting from a safe locked-down preset. Everything runs locally in your browser — nothing is uploaded and there is no signup; you just paste the generated config into your own server.

How to use CSP & Security Header Builder

  1. Start from the safe starter policy that is loaded by default (default-src/script-src locked to 'self', frame-ancestors 'none', and sensible image/style rules).
  2. In the Content-Security-Policy section, tick the source keywords each directive may load from — 'self', 'none', 'unsafe-inline', 'unsafe-eval', https:, data: or blob: — across the 12 directives (default-src, script-src, style-src, img-src, font-src, connect-src, media-src, frame-src, frame-ancestors, form-action, base-uri, object-src). Choosing 'none' overrides the other sources for that directive.
  3. Under 'Other security headers', toggle HSTS (1 year, with optional includeSubDomains and preload), X-Content-Type-Options: nosniff, and the Permissions-Policy camera/mic/geo lockdown.
  4. Pick an X-Frame-Options value (SAMEORIGIN, DENY or Off) and a Referrer-Policy (strict-origin, no-referrer, same-origin or Off) using the segmented controls.
  5. In the Output section, choose a format — Headers, nginx, Apache, or Meta tag — and click Copy to grab the generated config.
  6. Paste the result into your server config or HTML head; use 'Reset to a safe starter policy' to start over.

Frequently asked questions

Is my configuration uploaded or sent to a server?
No. The entire builder runs locally in your browser — your CSP and header choices are assembled on your device and nothing is ever uploaded. You copy the output and paste it into your own server config.
Is it free and do I need an account?
Yes, it is completely free with no signup, account, or watermark.
What output formats can I copy?
Four: raw HTTP headers, an nginx config (add_header lines), an Apache config (Header set directives), and a CSP <meta> tag. A note reminds you that only CSP works as a meta tag — HSTS, X-Frame-Options and the rest must be sent as real HTTP response headers.
Which CSP directives and source keywords are supported?
Twelve directives — default-src, script-src, style-src, img-src, font-src, connect-src, media-src, frame-src, frame-ancestors, form-action, base-uri and object-src — each toggling among seven sources: 'self', 'none', 'unsafe-inline', 'unsafe-eval', https:, data: and blob:.
What does the default starter policy include?
A safe modern baseline that locks default-src and script-src to 'self', allows 'unsafe-inline' styles and https/data images (a common reality), sets frame-ancestors and object-src to 'none', plus HSTS with includeSubDomains, nosniff, X-Frame-Options SAMEORIGIN, strict-origin Referrer-Policy and the Permissions-Policy lockdown.
How is X-Frame-Options related to CSP here?
The tool exposes both: X-Frame-Options (SAMEORIGIN/DENY) is the older clickjacking guard, while the frame-ancestors CSP directive is the modern equivalent. You can set frame-ancestors 'none' in the CSP section and choose an X-Frame-Options value for older-browser coverage.

People also search for

CSP & Security Header Builder is also known as content security policy generator, csp header generator, security headers generator, content security policy examples, hsts and x-frame-options builder, csp meta tag generator, how to set up csp.