Generator Settings
Policy strategy
Strict — nonce + strict-dynamic (recommended)
Host allowlist — name every origin
Report-only starter — observe first, enforce later
Lockdown — self only, no third parties
Your origin
Used for report endpoints and absolute examples.
'self'
covers your own origin in the policy itself.
Third-party services you use
Each one adds the exact origins that service needs — nothing wider.
Additional origins
One per line as
directive origin
. Anything you add here is merged into that directive.
Hardening
object-src 'none'
Blocks Flash and legacy plugin vectors. No modern site needs it.
base-uri 'none'
Stops an injected
<base>
tag re-pointing every relative URL.
frame-ancestors 'none'
Clickjacking protection. Replaces
X-Frame-Options
.
form-action 'self'
Stops an injected form posting your data elsewhere.
upgrade-insecure-requests
Rewrites http:// subresources to https:// automatically.
Allow inline styles
Most frameworks need this. Far lower risk than inline scripts.
Deployment
Report-Only mode
Nothing is blocked; violations are reported. Always start here.
Include reporting endpoint
Adds
report-to
plus the legacy
report-uri
.
Report endpoint
Generate
Reset
Generated Policy
ready
Header
Server config
Analysis
Directive reference
Content-Security-Policy-Report-Only
Copy
Download
Platform
Nginx
Apache / .htaccess
Express (helmet)
Vercel — vercel.json
Netlify — _headers
Cloudflare Worker
HTML meta tag
nginx.conf
Copy config