What does this tool do?
The CSP Generator helps you build a Content-Security-Policy header directive by directive with simple checkboxes. Toggle directives like default-src, script-src, and img-src, edit their source values, and export the result as a raw HTTP header, Nginx config, Apache config, or HTML meta tag. It's built for developers and site admins who want to harden their site against injection attacks.
How to use it
- Choose the required options or length.
- Generate the secure result.
- Copy and store the result safely.
What CSP actually protects against
Content-Security-Policy tells the browser which origins are allowed to load scripts, styles, images, and fonts, sharply limiting the impact of cross-site scripting (XSS). For example, script-src 'self' permits JavaScript only from your own domain, so inline code injected by an attacker never runs. In this tool you tick each directive and supply values like 'self', 'none', data:, or trusted domains to assemble a tailored policy step by step.
Roll out safely with Report-Only
Enforcing a brand-new CSP on a live site can accidentally block legitimate resources. Enable Report-Only mode and the header becomes Content-Security-Policy-Report-Only: the browser blocks nothing and merely reports violations. Add an endpoint like /csp-report in the report-uri field to collect those reports, refine your directives until they're clean, then turn Report-Only off to switch to full enforcement. This staged approach avoids breaking production.
Frequently asked questions
How do I apply the output to Nginx or Apache?
Pick the 'nginx' or 'apache' tab. For Nginx, paste the add_header line into a server or location block; for Apache, add the Header always set line to your virtual host, then reload the configuration.
Should I use the meta tag or the HTTP header?
Prefer the HTTP header when you can; it's more complete and some directives like frame-ancestors don't work in a meta tag. If you can't edit server config, the meta http-equiv tag is a practical fallback.
Is CSP Generator free?
Yes. CSP Generator and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. CSP Generator works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.