Content Security Policy generator and checker

A Content Security Policy tells browsers which sites your pages may load scripts and other files from, so an injected script has nowhere to run. Build one for the services you use, or paste yours to have it checked. Free, and nothing you enter is stored.

Jump to: Build a policy · Check a policy

Build a policy

Where does your site run?

How your pages are builtMy pages have scripts written into the HTML Common on WordPress, Squarespace, Shopify and Wix. Weakens the policy, so leave it off if you can.My pages have styles written into the HTML Most sites do; a small risk next to scriptsImages can come from any secure site Easiest if you embed images from elsewhere

Check a policy

Why start in report-only mode

A policy that's too strict blocks parts of your own site: a chat widget, a payment form, your analytics. Report-only mode lets you see what would break before anything does. Our security headers guide explains CSP alongside the other headers, and the security headers generator writes them all at once.

Did it work? Run the free checkup

Once your changes are live, paste your address. The checkup shows what's still flagged, free.