CSP Generator

A Content Security Policy is an HTTP response header that controls which resources a browser is allowed to load for a page. By specifying trusted sources for scripts, styles, images, and other resource types, CSP prevents cross-site scripting (XSS) attacks and data injection. It is one of the most effective browser-enforced security controls available. CSP is set via the Content-Security-Policy header or a <meta http-equiv> tag.

'self' refers to the same origin as the page (same scheme, host, and port). It allows resources from your own server but not from other domains. Specifying a domain like https://cdn.example.com allows resources from that specific external origin. You can combine them: script-src 'self' https://cdn.example.com allows scripts from both your server and that CDN. Wildcard domains (*.example.com) are also supported but should be used carefully.

'unsafe-inline' allows inline scripts and styles — JavaScript in onclick attributes, <script> tags without nonces, and <style> blocks. While convenient, it largely defeats CSP's XSS protection since injected inline code would also be permitted. The better alternatives are nonces (a random token added to each inline script tag and the CSP header) or hashes (a hash of the exact inline script content). Both allow specific inline code while blocking injected scripts.

upgrade-insecure-requests instructs browsers to automatically upgrade all HTTP resource requests on the page to HTTPS before fetching them. This is useful for migrating sites from HTTP to HTTPS — instead of updating every hardcoded http:// URL in your templates and database, you can add this directive as a temporary measure. However, it does not fix mixed content caused by non-upgradeable resources, and it is not a substitute for updating your URLs to use HTTPS directly.