CSP builder

Naming one directive silently disables the rest.

A Content-Security-Policy is the header that stops an injected script from running — and the one developers get wrong most, because writing any directive quietly switches off the default-src fallback for it. Tick what your site actually loads and get a hardened, paste-ready policy that starts from default-src 'self' and only opens what you need.

Starts from a strict floor
Graded by the live /csp rules
Paste-ready header
Free, no account

What your pages need

Inline styles (style="" / <style>) adds 'unsafe-inline' to style-src — common, and a smaller risk than inline script Inline <script> you can't remove adds 'unsafe-inline' to script-src — prefer a nonce; the readiness check below will flag this data: images (inline base64 / SVG) adds data: to img-src data: fonts adds data: to font-src Let your own pages frame this site frame-ancestors 'self' instead of 'none' Upgrade insecure requests to HTTPS adds upgrade-insecure-requests

Report violations to optional — a report-uri URL or path; roll out in report-only mode first

Programmatic: /api/csp-builder?svc=ga&svc=gfonts&… returns {csp, ready, findings} — build the header in a script or CI. Already serve a CSP? Grade it instead.