CometWeb tools
CSP generator
Build a Content-Security-Policy · locally in your browser
No notes — the policy looks solid.
Content-Security-Policy: default-src 'self';
script-src 'self';
style-src 'self';
img-src 'self' data:;
font-src 'self';
connect-src 'self';
frame-ancestors 'none';
form-action 'self';
base-uri 'self';
object-src 'none';
upgrade-insecure-requestsThis CSP generator assembles a Content-Security-Policy header from the directives you choose and flags the values that genuinely weaken it: unquoted keywords, unsafe-inline in scripts, wildcards, and missing defensive directives. It reviews the policy text, not your site — whether a page loads under it is something only a browser can tell you.
What weakens a CSP
The quotes are not cosmetic. script-src self and script-src 'self' are different policies: the first allows a host named "self", which does not exist. The policy still applies — it just means something other than intended. This is the most common silent CSP mistake.
unsafe-inline in script-src defeats the point. CSP mostly protects against injected inline script executing; allowing it back leaves that door open. Where it cannot be avoided, use a nonce or a hash — modern browsers then ignore unsafe-inline anyway.
Three directives are easy to forget and worth adding: base-uri closes off base-tag injection, frame-ancestors replaces X-Frame-Options, and object-src 'none' shuts down the old plugin vector.
This reviews the policy text. Whether your site loads under it depends on what it actually requests — find that out with Report-Only before enforcing.
Observe violations first
Build a policy around the resources your site actually uses. Test it in staging as Content-Security-Policy-Report-Only. Exercise login, forms, payments and integrations; loading the homepage alone is not enough.
MDN · Content Security Policy ↗Parts of a policy
- ''Keywords
- 'self', 'none' and 'unsafe-inline' need quotes. Unquoted they are read as hostnames.
- NNonce
- A one-time token on a script tag. Its presence makes modern browsers ignore unsafe-inline.
- FAframe-ancestors
- Who may embed your page in a frame. The modern equivalent of X-Frame-Options.
- ROReport-Only
- The policy reports violations without blocking anything. The safe way to roll one out.
Fill in the directives you need, or start from the starter policy, and copy the finished header. The tool flags weakening values and missing defensive directives as you go. Everything is computed locally in your browser.
Because without them the browser reads it as a hostname. script-src self allows a server called "self" rather than the page’s own origin — the policy still applies, it just means something other than what you intended.
Partly. The <meta http-equiv> form works for most directives, but frame-ancestors, report-uri, report-to and sandbox are ignored in it — silently. That is why this generator strips them from the meta output and names what it removed.
With Report-Only. The policy then reports violations without blocking anything, so you can see what would break before you enforce it.
No. It reviews the policy you build here. Whether your site loads under it depends on the resources it requests — that is for a browser to answer, ideally in Report-Only mode.
What else might come in handy
TLS, headers, cookies and exposure — with a score breakdown and a remediation plan.