Content Security Policy Generator
Build a Content Security Policy header that blocks injected scripts, with warnings for the settings that quietly disable it.
Build a Content Security Policy header that blocks injected scripts without breaking your own site.
Policy review
Report only. Violations are logged but nothing is blocked, which is the right way to start. Switch to enforcing once the reports are quiet.
frame-ancestors 'none' blocks clickjacking.
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-src 'none'; frame-ancestors 'none'; upgrade-insecure-requestsAbout the content security policy generator
A Content Security Policy tells the browser which sources it may load scripts, styles and images from. Done properly it is the strongest defence there is against cross site scripting, because an injected script has nowhere it is allowed to run from.
It is also easy to write a policy that looks strict and protects nothing. Allowing unsafe-inline in script-src removes most of the benefit, since injected inline script is exactly what the policy exists to stop. Anything like that is flagged here.
How to use it
- 1Set default-src to 'self' as a baseline.
- 2Narrow each directive to the sources you actually use.
- 3Add frame-ancestors 'none' to block clickjacking.
- 4Start in report only mode.
- 5Watch the reports, fix what breaks, then switch to enforcing.
Questions
Why start in report only mode?
An enforcing policy that is slightly wrong breaks your site for every visitor. Report only logs violations without blocking, so you can find what you missed safely.
Why is unsafe-inline a problem?
It allows any inline script to run, which is precisely what an injection attack produces. It removes most of the protection the policy was meant to provide. Use a nonce or a hash instead.
What does frame-ancestors do?
It controls who may embed your page in an iframe. Setting it to 'none' prevents clickjacking and supersedes the older X-Frame-Options header.
Does a meta tag work as well as a header?
Mostly, but not entirely. Some directives including frame-ancestors are ignored in a meta tag, and the policy only applies to content loaded after the tag is parsed. Prefer the header.