All tools

CSP Header Builder

Network

Build Content-Security-Policy headers with presets and validation

Select the resource types your page actually needs (scripts, styles, images, fonts) and specify allowed sources to build a `Content-Security-Policy` header, starting from a strict preset and loosening individual directives only where something genuinely requires it, rather than the other way around. There's also a validation path: paste an existing CSP header and get flagged issues like a missing `default-src`, use of `unsafe-inline`/`unsafe-eval`, or overly broad wildcard sources that weaken the policy more than intended. It generates the header value or meta tag only. Deploying it to your actual server response headers or HTML is still on you. A strict CSP genuinely can break a site that relies on inline scripts/styles or third-party embeds, so testing in report-only mode (`Content-Security-Policy-Report-Only`) before enforcing is worth doing rather than skipping. Nonce and hash placeholders for inline scripts are supported, though the real nonce/hash values still need to be generated server-side per request.

cspsecurityheaderscontent-security-policy

How to use CSP Header Builder

  • 1.Select the resource types you need (scripts, styles, images, fonts) and specify allowed sources to build a `Content-Security-Policy` header.
  • 2.Start from a strict preset and loosen individual directives only where your app actually needs external resources.
  • 3.Paste an existing CSP header to validate it and catch overly permissive directives like `unsafe-inline` before shipping.

Frequently asked questions

Does this deploy the CSP header for me?
No, it generates the header value or meta tag — you still need to add it to your server response headers or HTML.
Will a strict CSP break my site?
It can, especially if you rely on inline scripts/styles or third-party embeds — always test in report-only mode (`Content-Security-Policy-Report-Only`) before enforcing.
What does the validation check for?
It flags common issues like missing `default-src`, use of `unsafe-inline`/`unsafe-eval`, and wildcard sources that weaken the policy.
Does it support nonce or hash-based script allowlisting?
Yes, you can add nonce or hash placeholders for inline scripts, though you'll need to generate the actual nonce/hash values server-side per request.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/csp-builder \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"directives":{"default-src":["'self'"],"script-src":["'self'","cdn.example.com"]}}'

Get an API key from your dashboard · Full API docs →

Related tools

Referrer-Policy Header BuilderBuild a Referrer-Policy header value from one or more policy tokens with a plain-English explanation of each and warnings for risky choices like unsafe-urlNetworkSame-Site Cookie Attribute CheckerParse a Set-Cookie header and validate its attribute combination: SameSite=None requires Secure, __Host-/__Secure- prefixes have their own required attributes, and a missing Secure or overly long Max-Age gets flagged.NetworkCache-Control Header BuilderBuild and explain an HTTP Cache-Control response header from directives like max-age, s-maxage, no-store, and immutableNetwork