CSP Generator

What is a Content Security Policy?

A Content Security Policy (CSP) tells the browser which sources of scripts, styles, images, and other resources a page is allowed to load. It's normally set as an HTTP response header, though a <meta> tag works too if you can't control server headers directly. A well-built policy blocks most cross-site scripting (XSS) attacks even if an attacker manages to inject markup into your page.

Two ways to generate one

Build from live URL crawls a single page, records every origin it loads scripts, styles, images, and other resources from, and builds a policy from that — no CSP knowledge required. It's a fresh policy based on what the page actually loads; it doesn't check whether the page already has a CSP.

Build from a template starts from a preset (Strict, Moderate, or Permissive) instead, for when you don't have a URL to scan or want a generic starting point.

For automated generation, use our public API.

Choosing a CSP type

An allow-list policy names trusted origins per directive — flexible, but a policy that's too broad is easy to bypass.

A strict policy (nonce- or hash-based) is harder to bypass but comes with a real tradeoff: a nonce must be freshly generated by your server on every single response and matched exactly in the header and every inline tag, while a hash is a fingerprint of the script's exact content, so it only works for scripts that don't change between deploys.

Bypasses

Generating a policy also produces an analysis of it. Some results are ordinary misconfigurations, like a missing directive or an unsafe-inline allowance. Others are bypasses: a domain already on your allow-list that has a real, documented way around it, like a JSONP endpoint an attacker can use to run their own script.

Monitoring your CSP

A new script can get added without updating the header, or a deployment can strip the header entirely, so a CSP that's correct today may not stay that way. Testomato can check that your Content-Security-Policy header is present and matches an expected value on every check run, so a regression gets caught instead of sitting unnoticed.

Read more about CSP monitoring on the Testomato blog.