🛠️ FreeTool.jp JP
FAQ Privacy Policy

CSP Header Generator

Build CSP headers with a visual GUI

プリセット:

CSP セキュリティチェック

✓ セキュリティ上の問題なし

HTTP Header
<meta> Tag

Nonce ジェネレータ

Use in: <script nonce="[value]"></script>

About CSP Header Generator

The 'CSP Header Generator' is an essential free online tool for web developers, server administrators, and security engineers to accurately and safely build Content Security Policy (CSP) HTTP response headers through a simple graphical user interface, without requiring deep programming expertise. CSP is a critical security mechanism that explicitly declares to the browser which domains are permitted to load scripts, stylesheets, images, fonts, frames, and other resources on a page, serving as one of the most important defense layers against XSS (Cross-Site Scripting) attacks and data injection attacks. CSP header syntax is notoriously complex, involving over a dozen directives such as default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, media-src, object-src, base-uri, form-action, frame-ancestors, and report-uri, each requiring correct combinations of values like 'self', 'none', 'unsafe-inline', 'unsafe-eval', wildcards (*), and specific URL domains.

This tool lets you configure all directives intuitively using checkboxes and text inputs, automatically outputting results in both HTTP header format (Content-Security-Policy: ...) and HTML meta tag format. Additionally, three presets (Strict, Moderate, Relaxed) are available for common security levels, allowing you to load recommended settings with one click and customize from there. Built-in CSP Security Validator automatically detects policy vulnerabilities, warns about dangerous unsafe-inline/unsafe-eval directives, and checks for missing critical settings.

Report-Only Mode lets you test the policy before enforcing it, and the Nonce Generator creates authentication values needed for Strict CSP. All processing runs entirely in your browser, ensuring zero risk of server configuration data leaking externally.

How to use CSP Header Generator

  1. Select a preset (Strict, Moderate, or Relaxed) or configure each directive individually. Hover over directive labels to see tooltips with descriptions.
  2. For each directive, check keywords like 'self', 'none', 'unsafe-inline', and add custom URLs as needed.
  3. Review the 'CSP Security Check' panel below to see automatic validation results and fix any warnings or errors.
  4. Before deploying to production, check 'Report-Only Mode' to test the policy and set the header on your server to collect violation reports.
  5. Copy the generated CSP header (HTTP format or meta tag format) using the copy button and paste it into your server configuration or HTML file.

Benefits of CSP Header Generator

  • [Build Complex CSP Syntax Accurately with an Intuitive GUI] Create CSP headers that require combining dozens of directives and multiple source values using simple checkboxes and text inputs. Completely eliminates typos and syntax errors from manual writing, generating policies that are guaranteed to work correctly.
  • [Automatic Vulnerability Detection with Security Checker] The generated policy is automatically validated against security best practices, detecting dangerous unsafe-eval/unsafe-inline directives, missing object-src settings, and excessive wildcard (*) usage. Inspired by Google CSP Evaluator, it promotes migration to Strict CSP.
  • [Instantly Set Security Levels with 3-Tier Presets] Apply Strict (most restrictive: 'self' only), Moderate (balanced: allows inline styles), or Relaxed (permissive: broadly allows external resources) presets with one click, giving you the optimal starting point to customize for your project's security requirements.
  • [Simultaneous Output in Both HTTP and Meta Tag Formats] Automatically generates both HTTP header format for web server config files (Nginx/Apache) and HTML meta tag format for direct embedding, ensuring immediate deployment in any environment. Fully local processing means zero risk of server configuration data leakage.
  • [Test Before Enforcement with Report-Only Mode] Use Report-Only headers to test your policy before enforcement, and collect actual violation logs via report-uri. Deploy incrementally while minimizing the risk of breaking your application.
  • [Nonce Generator for Strict CSP] One-click generation and copy of nonce values for inline scripts and styles. Easily migrate to secure script-src/style-src configurations without unsafe-inline.

他のカテゴリ

Image Tools PDF Tools Audio Tools Video Tools Calculators Business Documents Design Tools Other

Text Tools の人気ツール TOP 10

📝 Lyrics Editor
📝 Width Convert
📝 Base32 Encoder Decoder
📝 Slug Gen
📝 ASCII Art Gen
📝 UUID Gen
📝 Unix Timestamp
📝 Emoji Picker
📝 Meta Tag Generator
📝 Text Repeater

Text Tools のすべてのツール (58件)