Content Security Policy Generator
Build a solid Content-Security-Policy header directive by directive, with output for any server.
Runs 100% in your browser — nothing is ever uploaded.
What is CSP Generator?
This free CSP generator lets you assemble a Content-Security-Policy header without syntax mistakes. Fill in each directive — default-src, script-src, style-src, img-src, font-src, connect-src and frame-ancestors — toggle upgrade-insecure-requests, and get the policy as a raw header, an Nginx add_header line, an Apache Header set line, or an HTML meta tag. A well-crafted CSP is one of the strongest defenses against XSS attacks.
How to use CSP Generator
- Open the tool — no signup, no upload, everything runs in your browser.
- Fill in the policy options in the form; sensible defaults are pre-selected.
- The CSP output updates instantly with every change you make.
- Copy the result or download it as a ready-to-use file.
Frequently asked questions
Is this CSP generator free to use?
Yes — this CSP generator is completely free with no signup, no limits, and no watermarks. Use it as often as you like.
What does 'self' mean in a CSP directive?
'self' allows resources from your own origin only — same scheme, host and port. It must be written with the quotes ('self') inside the policy, and it does not include your subdomains.
Is my configuration data private?
Absolutely. Everything is generated locally in your browser with JavaScript — no data, settings, or file contents are ever sent to any server.
Do these tools touch my servers?
No. OpsForge tools are pure calculators and generators that run in your browser — they never connect to your infrastructure. You copy the result and apply it yourself.
Is the chmod calculator accurate for all systems?
Yes — octal permission notation is a POSIX standard, so the results apply identically on Linux, macOS and BSD.
Will more DevOps tools be added?
Yes — Dockerfile, docker-compose, nginx and CI config generators are on the roadmap. Everything will stay free and client-side.