# Content Security Policy Generator

> Build a CSP header from common presets, with each directive explained.

To generate a Content Security Policy, choose a preset and each directive is explained alongside the header. Report-only mode is on by default because an enforced CSP that blocks your own scripts takes a site down immediately — deploy in report-only, check the console, then enforce.

**URL:** https://convertto.tech/t/csp-generator
**Category:** Developer Tools (https://convertto.tech/c/developer-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Choose the policy preset.
2. Turn "Report-only mode" on or off as needed.
3. The result appears immediately — copy or download it.

## FAQ

### Why avoid unsafe-inline for scripts?

It permits inline script tags and event-handler attributes, which is exactly the vector XSS uses. A CSP with unsafe-inline in script-src provides very little protection. Use nonces or hashes instead.

### What is frame-ancestors for?

It controls who can embed your page in an iframe, preventing clickjacking. It supersedes X-Frame-Options and is more flexible, since it accepts a list of allowed origins.

## Related tools

- [HTTP Security Header Analyser](https://convertto.tech/t/http-header-analyser): Paste response headers and get a security grade, with what is missing and why it matters.
- [MIME Type Lookup](https://convertto.tech/t/mime-type-lookup): Find the correct MIME type for any file extension, and vice versa.
- [HTML Entity Encoder & Decoder](https://convertto.tech/t/html-entity-encode-decode): Convert characters to HTML entities and back — escape markup safely for display.
- [HTTP Header Checker](https://convertto.tech/t/http-header-checker): Follow every redirect, grade the security headers and read the cookie and caching settings.
- [HTTP Status Code Reference](https://convertto.tech/t/http-status-codes): Look up what any HTTP status code means and when to use it.
- [URL Parser](https://convertto.tech/t/url-parser): Break a URL into protocol, host, path, query parameters and fragment.
- [JWT Decoder](https://convertto.tech/t/jwt-decoder): Decode a JSON Web Token to inspect its header, payload and expiry — locally, never sent anywhere.
- [URL Encoder & Decoder](https://convertto.tech/t/url-encode-decode): Percent-encode text for safe use in URLs, and decode encoded URLs back to readable text.