Security Utilities

Content Security Policy (CSP) Studio

Build, customize, and audit Content-Security-Policy (CSP) headers with real-time security evaluation and 1-click Nginx & Apache exports.

Presets:
1Script & Style Execution
Critical XSS Defense
'self''unsafe-inline'https://www.googletagmanager.comhttps://www.google-analytics.com
'self''unsafe-inline'https://fonts.googleapis.com
2Images, Fonts & Connections
Media Policy
'self'data:https:blob:
'self'https://www.google-analytics.comhttps://api.vitalsaudit.com
'self'https://fonts.gstatic.comdata:
3Framing & HTTPS Enforcements
Real-Time Security Audit Evaluation
script-src contains 'unsafe-inline'
Allows execution of inline <script> tags and onclick handlers, reducing defense against Cross-Site Scripting (XSS).
object-src 'none' active
Prevents execution of legacy Flash/Java plugins and ActiveX controls.
Clickjacking protection active
frame-ancestors is restricted to 'self'.
Automatic HTTPS upgrade active
upgrade-insecure-requests converts HTTP asset requests to HTTPS.

About this tool

Comprehensive documentation & audit utility guide
Verified Utility

Content Security Policy (CSP) is an HTTP header that allows site operators to restrict the resources (such as JavaScript, CSS, Images, and WebSockets) that the browser is allowed to load for a given page. CSP is the primary defense against Cross-Site Scripting (XSS) and Clickjacking.

How it works
1
Select Policy Preset

Choose an Enterprise Strict, Web App & Analytics, or Custom starter configuration.

2
Configure Directives

Toggle trusted sources for scripts, styles, images, fonts, and WebSocket endpoints.

3
Review Security Audit

Check real-time security warnings against unsafe-inline, unsafe-eval, and framing.

4
Export Header Configuration

Copy the HTTP response header, HTML meta tag, or Nginx/Apache directives.

What it checks
Directives support: default-src, script-src, style-src, img-src, font-src, connect-src, frame-ancestors, object-src
Automatic HTTPS enforcement via upgrade-insecure-requests and block-all-mixed-content
Real-time XSS and Clickjacking safety evaluation with security risk indicators
One-click multi-format export for HTTP Headers, HTML Meta tags, Nginx, and Apache .htaccess