⛨
CSP Generator
Resolve what each directive actually applies along the fallback chain, audit silently ineffective forms (unsafe-inline ignored once a nonce exists, strict-dynamic ignoring allowlists, the four directives meta cannot carry), and export as header / meta / Nginx / Next.js.
Runs in browserSecurityHTTP headers
Loading tool…
How to use
- Directives are not independent switches but a fallback chain: omitting img-src does not free images, it falls back to default-src. Conversely, default-src 'none' turns off every fetch directive you did not list.
- The Effective tab shows which directive actually decides each one and with what sources — more useful than the output itself, because silent fallback is the most common way a CSP ends up wrong.
- base-uri, form-action, frame-ancestors, sandbox and the reporting directives are not in the chain. default-src 'none' does not stop <base> injection or form exfiltration.
- When script-src has both 'unsafe-inline' and a nonce/hash, CSP3 ignores 'unsafe-inline' — it looks looser but the nonce wins and inline is blocked.
- With 'strict-dynamic', 'self' and host allowlists are ignored by CSP3 browsers; keeping the old allowlist only makes people believe it still applies.
- Report-Only reports but never blocks. Shipping it is the same as having no CSP; switch back to enforcement once observation ends.
- frame-ancestors / report-uri / report-to / sandbox are ignored inside <meta> and only work through HTTP headers.