CSP Builder

Build and validate Content Security Policy headers

STRICT CSP (SECURE)

Content Security Policy Directives

default-src:

script-src:

style-src:

img-src:

connect-src:

font-src:

object-src:

report-uri:

upgrade-insecure-requests (Auto-upgrade HTTP to HTTPS)

Generated Security Policy

default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-rAnd0m'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data: https:; connect-src 'self' https: wss:; font-src 'self' data:; object-src 'none'; upgrade-insecure-requests; report-uri /api/csp-report

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-rAnd0m'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data: https:; connect-src 'self' https: wss:; font-src 'self' data:; object-src 'none'; upgrade-insecure-requests; report-uri /api/csp-report">

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-rAnd0m'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data: https:; connect-src 'self' https: wss:; font-src 'self' data:; object-src 'none'; upgrade-insecure-requests; report-uri /api/csp-report" always;