1. Clear value up front
The first screen explains what the toolkit does and where to begin.
Practical • Static-first • Security-focused
Build a cleaner CSP workflow without guessing.
This site brings together a CSP generator, header audit tools, and implementation guides for teams shipping static sites, Jamstack apps, and frontend-heavy platforms.
01 / Start with the task
Choose whether you need to generate a policy, inspect real headers, or understand a platform-specific setup.
02 / Keep the flow simple
Generate first, validate with checkers, and use the guide or FAQ only when you need context.
Tools
Guide
FAQ
AI can summarize the theory, but this site helps you verify the live header.
Use the articles to understand the pattern, then jump into the tools when you need a real answer from a real page.
The fastest path is always: generate, check, compare, and only then enforce.
Open the generator
Build a copy-ready policy, share it with a link, and move from report-only to enforcement with confidence.
Check a live URL
Inspect the real response header before you guess. The browser and the CDN do not always match the config file.
Debug with DevTools
Use Chrome's console, network panel, and Issues tab to turn a CSP violation into a fixable instruction.
Start with the two jobs that matter most
The homepage stays focused on getting people to the right tool fast.
Explanations live deeper in the guide and FAQ, not in the hero.
CSP Generator
Build a copy-ready policy string with report-only, nonce, hash, and common directive helpers.
Security Headers Checker
Paste response headers and quickly see what is missing, why it matters, and how to fix it.
CSP Checker
Fetch real response headers through a proxy or paste them manually to inspect CSP coverage.
CSP Hash Generator
Compute sha256-… hashes for inline scripts or stylesheets before pasting them into your policy.
CSP Evaluator
Score a Content-Security-Policy header from 0 to 100 with explanations of every risk.
CSP Diff
Compare two policies directive-by-directive to see what changed between report-only and enforce.
Cookie Security Checker
Audit Set-Cookie headers for Secure, HttpOnly, SameSite, and the __Host- / __Secure- prefixes.
CSP Bypass Lab
Run your HTML under your CSP in a sandboxed iframe and see which payloads are blocked.
Permissions-Policy Helper
Pick the browser features your site uses and emit a copy-ready Permissions-Policy header.
SRI Hash Generator
Compute integrity hashes for any external <script> or <link> so CDN tampering is detectable.
Cross-Origin Headers Visualizer
Understand COOP, COEP, CORP, and OAC — and one-click the config that unlocks SharedArrayBuffer.
Meta Tag & OpenGraph Inspector
Spot missing og:, twitter:, viewport, canonical, and theme-color on any URL or pasted HTML.
robots.txt Generator & Tester
Edit a robots.txt visually and immediately check whether a URL would be allowed or blocked.
sitemap.xml Validator
Validate any sitemap for required fields, http/https consistency, long URLs, and 50K cap.
JSON-LD / Schema.org Validator
Detect Schema.org types, check required fields, and surface common structured-data errors.
Email Auth (SPF / DKIM / DMARC)
Inspect a domain's SPF, DKIM, and DMARC records via DNS-over-HTTPS — no backend required.
Redirect Chain Visualizer
Follow every hop in a redirect chain, see status codes and timings, and catch loops.
Why this site is structured this way
Each section has a job: conversion, explanation, or troubleshooting.
2. Low-friction entry points
The core tools stay visible so users do not have to interpret a large docs-first homepage.
3. Search-friendly support
Guides and FAQs handle concepts, platform details, and recurring implementation questions.
Platform entry points
Jump into the environment you are actually shipping.