CSP Header Generator
A Content-Security-Policy tells browsers which sources of scripts, styles, images and frames your site trusts, so injected scripts (XSS) can't run. Start from the safe defaults below, add the third-party hosts your site really uses, and copy the result.
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
Roll it out safely
Start in Report-Only mode: the browser logs violations in the developer console without blocking anything. Fix every legitimate source that shows up, then switch to enforcing mode. Avoid 'unsafe-inline' and 'unsafe-eval' in script-src where you can — they weaken most of the protection.
Check the live result with our security headers checker.
Frequently asked questions
Will a CSP break my website?
It can if you forget a source your site uses, which is why you should test in Report-Only mode first.
Can I set frame-ancestors in a meta tag?
No. frame-ancestors only works as an HTTP header, so it is removed from the meta-tag version.
Do I still need X-Frame-Options?
frame-ancestors replaces it in modern browsers. Keeping X-Frame-Options: DENY as well is harmless for older ones.
More free security tools
Advertisement