1001Ferramentas
Tools Categories Guides FAQ
About Contact Privacy Policy Terms of Use
🔒Security

Content-Security-Policy Builder

Build a Content-Security-Policy header by adding directives (default-src, script-src, img-src, frame-ancestors) with predefined sources.

Selecione fontes para cada diretiva. Adicione hosts customizados separados por espaço ou linha.


  


  






    
    
    

      

        
        

          
Build a Content-Security-Policy header

          
          
          

            
Few defences stop a script-injection (XSS) attack as well as the Content-Security-Policy. The catch is the syntax: so many directives and sources that it intimidates at a glance. Here the builder handles the tedious part for you, adding each directive in a guided way. No CSP grammar to memorise.

            
You compose the rules for directives such as default-src, script-src, img-src and frame-ancestors from common, predefined sources. The tool merges it all into a valid header. With that you can limit where the browser loads resources from, and the site's attack surface shrinks considerably.

            
The whole build happens in your own browser, in real time, with nothing leaving it. Handy for developers who want to harden their pages without getting tangled in CSP syntax.

          

        

        
        
        
        

          
Frequently asked questions

          

            
            

              Which directives and sources can I configure?
              
There are 11 directives: default-src, script-src, style-src, img-src, connect-src, font-src, frame-src, frame-ancestors, object-src, base-uri and form-action. Each one offers eight ready-made source checkboxes (self, unsafe-inline, unsafe-eval, none, data:, blob:, https: and the asterisk) plus a free-text field for your own hosts, separated by spaces. The page opens with a sensible starting point ticked: default-src self, object-src none, base-uri self and frame-ancestors none. Nonces, hashes, strict-dynamic and report-to stay out — those go in by hand.

            

            
            

              Does the Copy button grab the whole header or just the value?
              
Just the value. The panel displays the full line with the Content-Security-Policy: prefix for context, but what lands on the clipboard is only the policy itself — ready to paste as the header value in nginx, Apache, Express with helmet, or your CDN panel. If you would rather apply it via an http-equiv meta tag, paste the same value; just remember frame-ancestors has no effect in a meta tag and only works as a real HTTP header.

            

            
            

              Does the tool warn me when the policy turns out invalid or weak?
              
No — it just concatenates whatever you ticked, with zero validation of the result. You can combine none with other sources in the same directive, which produces an invalid policy (none must stand alone), and nothing flags that unsafe-inline or the asterisk in script-src all but cancels your XSS protection. Hosts typed into the free field get no syntax check either. Before going to production, test with the Content-Security-Policy-Report-Only header and watch the violations in the browser console.

            

            
          

        

        
      

    

    
    
    
    
    

      



  
Related Tools

  

    
      
  

    🛡️
    

      
Basic CSP Evaluator

      
Evaluates a Content-Security-Policy directive reporting unsafe-inline, unsafe-eval or wildcard issues.

    

  



    
      
  

    🛡️
    

      
Trusted Types Policy Builder

      
Generate CSP require-trusted-types-for and trusted-types directives with policy names — a modern anti-XSS mitigation.

    

  



    
      
  

    ⚠️
    

      
Mixed Content Detector

      
Scans http:// references inside HTML served over HTTPS, flagging insecure assets and links.

    

  



    
      
  

    🧱
    

      
COOP / COEP Headers Builder

      
Generate the COOP and COEP HTTP headers (Cross-Origin Opener/Embedder Policy) to isolate your origin. Required to safely use features like SharedArrayBuffer.

    

  



    
      
  

    📄
    

      
X-Content-Type-Options Header Check

      
Confirm X-Content-Type-Options is set to nosniff and explain MIME-sniffing risks when the header is missing.

    

  



    
      
  

    🧹
    

      
Clear-Site-Data Header Builder

      
Build a Clear-Site-Data header (cache, cookies, storage, executionContexts) — useful on logout to wipe origin data.