Content Security Policy (CSP) Builder
Build, inspect, and evaluate Content Security Policy directives in real-time. Detect XSS attack surfaces, unsafe script sources, and export ready-to-use HTTP headers.
Frequently Asked Questions
What is a Content Security Policy (CSP)?
CSP is an HTTP response header that restricts which scripts, styles, images, and frames a web browser is allowed to load, providing defense against Cross-Site Scripting (XSS) and data injection attacks.
Why is base-uri 'self' important?
If an attacker injects a malicious <base href="https://evil.com"> tag, all relative script and asset URLs will resolve to the attacker's server. base-uri 'self' blocks this injection.
What does frame-ancestors 'none' do?
It prevents external sites from embedding your application inside an <iframe>, completely mitigating Clickjacking attacks (modern equivalent of X-Frame-Options: DENY).
Is my policy tested privately?
Yes. 100% of policy compilation and risk assessment runs inside your browser.