Generate a CSP you can paste into production.
Start with a safe baseline, ship in report-only mode first, then tighten directives as you verify real requests and remove unnecessary sources.
Policy inputs
'self'.
Nonce helper
Generate a base64 nonce and append it to script-src and style-src.
No nonce has been generated yet.
Inline script hash
Paste inline script content, compute its hash, and insert the expression into script-src.
'sha256-…'
Related reading
Concepts and platform notes that pair well with this generator.
What is CSP
The fundamentals of Content Security Policy, written for static and headless sites.
Nonce vs hash
How to allow inline scripts safely without falling back to unsafe-inline.
Security headers best practices
A practical priority order for shipping CSP, HSTS, and the rest of the baseline.
CSP for Cloudflare Pages
How to ship the generated policy via _headers or Pages Functions.
CSP for Next.js
Middleware-based nonce, framework boot scripts, and production-only pitfalls.
CSP Hash Generator
Compute sha256-… hashes for inline scripts or stylesheets before pasting them into script-src.
CSP not working
Troubleshooting checklist: real response header, report-only mode, and inline code.
Official references
Specs and platform docs behind the generator's recommendations.