Build secure Content-Security-Policy (CSP 3) and a full security header suite (HSTS, X-Frame-Options, X-Content-Type-Options, Cross-Origin-Opener/Embedder/Resource-Policy, Permissions-Policy, Referrer-Policy), evaluate OWASP scores, and export Nginx, Apache, or HTML meta tags.
Paste a Content-Security-Policy header value — with or without the header name — to check it against the same rules used by the builder.
No issues found by these checks.
Cross-Origin-Embedder-Policy refuses to load any cross-origin resource that doesn't opt in itself (CORP header or CORS) — verify embeds like maps, ads or fonts still load before shipping this.
report-to needs an endpoint URL above — without one, this group has nowhere to send reports.
With both fields set, the export adds a Reporting-Endpoints header that report-to refers to, and keeps report-uri as a fallback for browsers without the Reporting API.
'nonce-{{nonceValue}}' Also set nonce="{{nonceValue}}" on the inline <script> tag itself. Generate a fresh, unpredictable value per response — never hardcode one.
{{hashResult}} Must match the inline content byte-for-byte, including whitespace — copy exactly what sits between the <script> tags.
Content Security Policy (CSP) is an HTTP header that restricts resources (JS, CSS, images, frames) the browser is allowed to load for a given page, neutralizing Cross-Site Scripting (XSS) and data injection vulnerabilities.
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy control cross-origin isolation — COOP stops other windows from holding a reference to yours via window.opener, while COEP/CORP together gate access to SharedArrayBuffer and similar powerful APIs. COEP is the one most likely to break something: it refuses to load any cross-origin resource that doesn't explicitly opt in, so verify embeds still work before shipping it. Permissions-Policy denies browser features (camera, microphone, geolocation, payment, USB) by default so an XSS or a malicious third-party script can't silently request them. Referrer-Policy controls how much of your URL leaks to the site a link is clicked to — strict-origin-when-cross-origin is the current browser default and a safe baseline.
Everything is generated locally in your browser as you edit the fields above. Nothing you configure here is saved between visits — copy or download the headers before leaving the page.
