Directives
Generated policy
Content-Security-Policy:
About this tool
Content-Security-Policy (CSP) is one of the most effective browser-enforced controls against cross-site scripting (XSS) and data injection attacks, a top finding in web application penetration tests and a requirement under many compliance frameworks. Each directive restricts a specific resource category; default-src acts as the fallback for any directive not explicitly set. Note that 'unsafe-inline' and 'unsafe-eval' significantly weaken the protection CSP provides: 'unsafe-inline' re-enables inline scripts (the primary XSS vector), while 'unsafe-eval' allows dynamic code evaluation. Prefer nonces or hashes for inline scripts in production. Use the Security Headers Checker to verify your deployed policy.