Build a strict Content-Security-Policy

For web developers defining permitted resources on a new page or tightening an existing site configuration.

Build a strict Content-Security-Policy from your allowed sources and receive one consistent directive ready for review and integration.

How to use

Start with the default source on the first line: it acts as the fallback for any resource type you do not list separately.
On the next line, list the origins allowed to serve scripts, writing them one after another separated by spaces.
Use the third line for connection sources, meaning the origins the page is allowed to reach with network requests.
Build the policy: the full set of directives appears in the result area, ready to be read from top to bottom.
Copy the policy into your header or configuration file, then roll it out in report-only mode before enforcing it.

Example

The sample allows a main domain as the default source, repeats that domain plus a delivery domain for scripts, and keeps a separate domain for connections. After building, check that the result area holds one coherent policy instead of several overlapping directives.

Input

https://example.com
https://example.com https://cdn.example.com
https://api.example.com

Output

default-src https://example.com; script-src https://example.com https://cdn.example.com; connect-src https://api.example.com; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Limits and formats

The generated policy sets rules but never tests your site, so you must confirm that every legitimate resource still loads.
An over-strict policy can break features without any visible error, which is why a report-only pass comes first.
Sources have to line up with each other: a domain used for scripts but missing from the default source needs an explicit entry.
Forms, downloads and embedded content follow other rules, so this policy does not cover the whole behaviour of a page.

Where processing happens

The policy is assembled inside your browser. The domains you type stay on your device, nothing is transmitted and no copy remains after you close the tab, which makes it practical to draft an internal configuration first.

Frequently asked questions

What is the difference between the default source and script sources?

The default source is the fallback for resource types you have not listed individually, while script sources only govern executable code. A domain allowed as a script source is therefore not automatically allowed for styles, images or connections.

Why does a page break after I publish the policy?

A legitimate origin is usually missing: an external style sheet, a font, an embedded frame or an analytics service. List every resource the page actually calls, add the missing domains, rebuild the policy and publish it again.

Can I reuse the same policy on several sites?

The wording carries over easily, but each site pulls in its own resources. Treat the text as a starting point, then adjust the domains for each project so you do not block something the page depends on.