Build Content-Security-Policy headers visually with presets and per-directive controls
default-srcFallback for all fetch directives
script-srcValid sources for JavaScript
style-srcValid sources for stylesheets
img-srcValid sources for images
font-srcValid sources for fonts
connect-srcValid targets for fetch/XHR/WebSocket
media-srcValid sources for audio/video
frame-srcValid sources for iframes
object-srcValid sources for plugins (Flash, etc.)
base-uriValid URLs for <base> element
form-actionValid targets for form submissions
frame-ancestorsWho can embed this page (clickjacking protection)
upgrade-insecure-requestsAuto-upgrade HTTP to HTTPS
Content-Security-Policy: default-src 'self'A Content-Security-Policy (CSP) header tells browsers which resources are allowed to load on your page. It prevents XSS attacks, data injection and clickjacking by restricting scripts, styles, images, fonts and other resources to trusted sources. This tool lets you build CSP headers visually instead of writing the complex syntax by hand.
Choose Strict, Moderate or Permissive as a starting point based on your security needs.
Toggle source values for each directive. Add custom domains where needed.
Enable Report-Only mode to test your policy without breaking your site.
Copy the generated header and add it to your server configuration.
Generate strong, random passwords with customizable length, symbols, numbers and uppercase letters.
Analyze password strength with entropy calculation, pattern detection and crack time estimation.
View any URL's HTTP response headers including security headers, caching and server info.
Check SSL certificate expiry, issuer, chain and protocol for any domain. Verify HTTPS security.
Query A, AAAA, MX, TXT, NS and CNAME records for any domain. View DNS configuration instantly.
Look up domain registration details including registrar, creation date, expiry and nameservers.