Content-Security-Policy Builder

No. The header, meta tag and nginx line are all generated in your browser from the directives you enter. Nothing you type is uploaded, logged or stored, so it is safe to build a policy for a production site.

A Content-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of script, style, images and other resources are allowed to load. Its main job is to reduce the impact of cross-site scripting (XSS) by blocking scripts and content from origins you did not approve.

A directive such as script-src takes a list of sources. A keyword source is a quoted token like 'self', 'none', 'unsafe-inline', 'unsafe-eval', a 'nonce-...' or a 'sha256-...' hash, and must keep its single quotes. A host source is a plain origin such as https://cdn.example.com. This builder keeps both exactly as you enter them.

Report-only mode emits the Content-Security-Policy-Report-Only header instead of the enforcing one. The browser checks every request against your policy and reports violations, usually to a report-uri, but does not block anything. It is the safe way to test a new policy before you enforce it.

upgrade-insecure-requests is a valueless directive that tells the browser to automatically request the https version of any http resource on the page. It helps a site move to HTTPS without hunting down every hard-coded http URL. This builder emits it as a bare directive with no source list.

An HTTP response header is the recommended way and supports every directive. A <meta http-equiv> tag is a fallback for static hosts where you cannot set headers, but it cannot use directives like frame-ancestors or report-uri. This tool gives you both plus an nginx add_header line so you can pick whichever fits your setup.