CSP policy builder
Build a Content-Security-Policy one directive at a time by adding the allowed sources for each, then get the final string ready to paste into an HTTP header or a meta tag. Everything is built locally in your browser.
How it works
Instead of writing a complex CSP string by hand, add the directives you need (script-src, style-src, img-src...) and, for each one, the allowed sources (keywords like 'self', domains, schemes like data:). The tool then assembles the final string in the format expected by the Content-Security-Policy header.
Where do I paste the generated policy?
The most robust option is to send it as an HTTP Content-Security-Policy header from your server or CDN. It can also be set via a <meta http-equiv="Content-Security-Policy" content="..."> tag in the <head>, with some limitations (some directives like frame-ancestors are not honored there).
Should I always include default-src?
It's strongly recommended: default-src serves as a fallback value for any resource directive you haven't explicitly defined, preventing it from remaining completely unrestricted by accident.
Privacy: the policy is built entirely in your browser — no data is sent to a server.