InputTestHub

Content Security Policy Generator

Builds a Content-Security-Policy header from your actual sources, with a report-only variant to test first.

Security Nothing uploaded No sign-up Free, unlimited
Security tool
Fill in the fields and press Generate.
In short Content Security Policy Generator is a free online tool on inputtesthub.com that builds a Content-Security-Policy header from your actual sources, with a report-only variant to test first. It needs no account, no download and no payment, and there is no daily usage limit. Everything is processed inside your own browser, so the data you paste is never uploaded to a server.

How to use the Content Security Policy Generator

  1. Fill in the fields with your own details.
  2. The generated code updates live in the output panel.
  3. Copy the code and paste it into your page, file or CMS.

About the Content Security Policy Generator

The Content Security Policy Generator builds a Content-Security-Policy header from your actual sources, with a report-only variant to test first. It runs as plain JavaScript inside the page, which means there is no upload step, no queue and no size limit imposed by a server — the only limit is your own device.

What people use it for

  • Adding a CSP to a site without breaking it.
  • Testing a policy in report-only mode first.
  • Getting the syntax right for cPanel or Nginx.
Deploy in Report-Only mode first and watch the console for a week. A CSP that blocks your own analytics or fonts is worse than no CSP, because you will disable it in a panic and never come back to it.

Frequently asked questions

Is there a limit on how often I can use the Content Security Policy Generator?
It is free, with no account, no trial and no daily cap. Every security tool on inputtesthub.com works the same way: open the page and use it.
Can you see what I put into this tool?
No. The Content Security Policy Generator runs entirely in your browser using JavaScript. Because the work happens locally, the tool also keeps working if your connection drops, and closing the tab is all it takes to discard everything.
What do people use the Content Security Policy Generator for most?
The most common reasons people reach for it: adding a CSP to a site without breaking it. Testing a policy in report-only mode first. Getting the syntax right for cPanel or Nginx. It is built for exactly those cases rather than being a general-purpose tool with this bolted on.
Is there anything to watch out for?
Deploy in Report-Only mode first and watch the console for a week. A CSP that blocks your own analytics or fonts is worse than no CSP, because you will disable it in a panic and never come back to it.
Does the Content Security Policy Generator work on a phone?
Yes. The page is responsive and the tool works in Chrome, Safari, Firefox, Edge and Samsung Internet on both Android and iOS. There is no app to install and nothing to sign into.

Related security tools

All 100
01

htpasswd Generator

Generates .htpasswd lines for Apache basic authentication using APR1-MD5, SHA-1 or crypt.

04

Privacy Policy Generator

Generates a privacy policy covering what you collect, why, how long you keep it and the rights…

06

Disclaimer Generator

Generates disclaimers for affiliate links, advice, earnings claims and external content.