It is an HTTP header that controls which origins the browser may use for scripts, styles, images, frames and other resources. Its main purpose is to mitigate XSS and content-injection attacks.
Carregando ferramenta… / Loading tool…
Build and analyze a Content-Security-Policy, flagging weaknesses like unsafe-inline and wildcards.
Content-Security-Policy is an HTTP header that tells the browser where scripts, styles, images and other resources may load from. Configured well, it mitigates attacks such as XSS and content injection. The catch is that values like 'unsafe-inline', 'unsafe-eval' and wildcards undo much of that protection, and lockdown directives such as object-src, base-uri and frame-ancestors are often forgotten. This tool analyzes a pasted policy, flags those weaknesses with a severity level, and helps you compose a policy from a form, all locally.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/csp-generator"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="CSP Builder & Analyzer"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
It is an HTTP header that controls which origins the browser may use for scripts, styles, images, frames and other resources. Its main purpose is to mitigate XSS and content-injection attacks.
default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com; img-src *; object-src 'none'Analysis and building happen only in the browser. No policy is sent to any server.