CSP builder
Check the directives you need and fill in sources (space-separated). See the security headers checker to test a live site's existing policy.
What is CSP builder?
A Content-Security-Policy header tells the browser exactly which sources are allowed to load scripts, styles, images, and other content on your page — one of the most effective defenses against cross-site scripting (XSS) attacks.
How to use it
Check the directives you need and fill in allowed sources for each (space-separated) — the complete header value is generated as you go.
Example
default-src 'self'; script-src 'self'; object-src 'none'