Content-Security-Policy (CSP) Header Builder & EvaluatorCSP Level 3 + OWASP
Construct strict Content-Security-Policy headers visually and audit existing policies against XSS bypass vectors, unsafe-inline risks, and nonce rules.
Compiled CSP Header
Switch to the Security Evaluator tab to inspect full XSS injection vectors, base-tag hijacking checks, and remediation guidance.
Google Recommended Strict CSP
- Always set
object-src 'none'to prevent plugin-based script execution. - Always set
base-uri 'none'or'self'to block relative script hijacking. - Avoid domain whitelists for scripts; prefer
'nonce-...' 'strict-dynamic'. - Never add
'unsafe-inline'without an accompanying nonce or hash.
Understanding Content-Security-Policy (CSP) Architecture
XSS Vector Neutralization
CSP restricts the sources from which executable scripts can be retrieved or run. By requiring cryptographic nonces or hashes and prohibiting 'unsafe-inline', stored and reflected XSS payloads cannot execute.
Base-Tag Hijacking Protection
Setting base-uri 'none' prevents attackers from injecting <base href="https://attacker.com"> tags, which would hijack all relative script imports and assets to malicious origins.
Clickjacking Defense
The frame-ancestors directive supersedes legacy X-Frame-Options headers, allowing fine-grained control over which parent origins may frame your site in an <iframe>.