CSP & security headers generator
Start from a strict baseline (default-src 'self', no plugins, no framing) and add the origins your site really loads, one directive per line. Nothing is fetched or uploaded — the policy is built in this page. Roll out with Report-Only first, then enforce.
Frequently asked questions
How do I find which sources my site needs?
Enable Report-Only, open your site with DevTools → Console: every blocked resource is logged with its directive. Add those origins here and repeat.
Why is 'unsafe-inline' not in the baseline?
Inline scripts are the main XSS vector CSP protects against. Add it only where you must (commonly style-src), or use nonces/hashes.
Should I enable HSTS preload?
Only if every subdomain serves HTTPS and you intend to submit to hstspreload.org — preload is hard to undo.
Can I set CSP with a meta tag?
Yes for most directives, but frame-ancestors, report-only and the other headers are ignored in meta — send real HTTP headers where you can.
How can I test headers without redeploying?
PlainHeaders can add or override response headers for sites you choose, so you can try a policy in your own browser first.