CSP Generator
Build a Content Security Policy header or meta tag from common directives directly in your browser. No upload is required.
How to use the CSP generator
Select the sources your website actually needs, then generate the policy. The tool produces both an HTTP Content-Security-Policy header value and a matching meta tag representation for quick reference.
What CSP directives control
Directives such as default-src, script-src, style-src, img-src, font-src and connect-src define where different resource types may load from. Directives such as object-src, base-uri and frame-ancestors add restrictions for specific browser behaviors.
Use the narrowest sources you can
A restrictive policy is easier to reason about when it names the origins your application actually requires. Avoid adding broad wildcards simply to make a policy pass. Likewise, avoid 'unsafe-inline' or 'unsafe-eval' unless your application genuinely depends on them and you understand the trade-offs.
Header versus meta tag
The HTTP response header is normally the preferred deployment mechanism because the server can deliver the policy with the document response. A meta tag can be useful for some static sites, but it does not provide every CSP capability and must be placed in the document head.
Test before enforcing
A new CSP can block legitimate scripts, styles, fonts, images or third-party integrations. Test the generated policy against the real site, review browser console reports and consider a report-only rollout when your infrastructure supports it before moving to enforcement.
Local processing
Your selections are processed in the browser. NeroTool does not need to upload your CSP configuration or website source to generate the result.
Frequently asked questions
What is a Content Security Policy?
Content Security Policy (CSP) is an HTTP response-header policy that restricts which sources a browser may use for scripts, styles, images, frames and other resources.
Does this CSP generator upload my configuration?
No. The generator builds the policy in your browser. It does not need a NeroTool server to process the configuration.
Should I use a CSP header or a meta tag?
An HTTP Content-Security-Policy response header is generally the preferred deployment method because it provides the browser policy at response time. A meta tag is useful in some static hosting situations but does not support every CSP feature.
Is the generated CSP guaranteed to work for my website?
No. CSP depends on the resources and integrations used by your site. Start with a policy that matches your actual sources, test it carefully and consider a report-only rollout before enforcing a restrictive policy.