d4 · tools · csp builder
The author-side companion to the headers grader: instead of scoring a live site, this helps you write and check a Content-Security-Policy before it ships. Paste an existing policy for a plain-English audit of every directive, or assemble a sensible one from controls and copy the Apache and nginx snippets. Everything runs in your browser; nothing you type leaves this page.
Paste a full Content-Security-Policy value (with or without the header name). Each directive is broken out with a plain-English verdict, and the common gaps are flagged.
Pick the sources you allow; the header value and server snippets rebuild as you type. The defaults are a deliberately strict starting point. Loosen only what your site genuinely needs.
A Content-Security-Policy is only as good as its weakest directive: an allowance like 'unsafe-inline' in script-src reopens the cross-site scripting hole the policy is meant to close. This tool checks the policy text you give it; it cannot see whether your pages actually load only the sources you have listed. Test in a browser and watch the console for CSP violation reports before enforcing, and consider Content-Security-Policy-Report-Only first.