// security header · starter policy

CSP Generator

Build a conservative starter Content-Security-Policy header. Test it with Report-Only before enforcing it in production.

✓ runs entirely in your browser

A CSP must match your actual assets. This generator is a starting point, not a complete security review.