Content Security Policy Generator

Generate CSP directives locally with a restrictive preset and warnings for broad unsafe source expressions; deployment still requires application-specific testing.

default-src

script-src

style-src

img-src

connect-src

font-src

object-src

base-uri

form-action

frame-ancestors

upgrade-insecure-requests

ReadyCSP is defense in depth. Test application behavior before enforcing a generated policy; this builder does not crawl your site or prove a policy is complete.

Local analysis is not remote verification

Unless a tool explicitly has a direct-fetch action, these HTTP tools do not contact endpoints. Browser fetch cannot bypass CORS, and generated policy text does not prove how a deployed server, browser, proxy or CDN will behave.