Quick Presets

default-src Default fallback for other directives

script-src Controls script execution sources

style-src Restricts inline style sources

img-src Allows image loading sources

connect-src Restricts XHR/fetch/WebSocket sources

font-src Restricts font loading sources

frame-src Controls embedded iframe sources

upgrade-insecure-requests Automatically upgrade HTTP requests to HTTPS

report-uri Endpoint to report CSP violations

Content-Security-Policy

default-src 'self';

Copied to clipboard!

Via HTTP Header: Add to your web server config (Apache, Nginx, etc.)

Via Meta Tag: Use <meta http-equiv="Content-Security-Policy" content="...">

Testing: Use report-only mode (Content-Security-Policy-Report-Only) to detect violations without blocking

Common Pitfalls: Avoid 'unsafe-inline' for scripts/styles. Don't use overly permissive policies. Monitor reports for issues.