Content-Security-Policy generator

Your policy

{{ directives.filter(d => tokensFor(d).length).length }} directive(s)

Type or paste a policy here (with or without a leading Content-Security-Policy:), or use the form below — the two stay in sync.

Report-Only mode (test without blocking anything)

A preset replaces the whole policy below — fine-tune from there.

{{ d.label }} ({{ d.key }})

Upgrade insecure requests (upgrade-insecure-requests)

Rewrites any http:// sub-resource request on the page to https:// before it's sent.

Report URI (report-uri)

Legacy but still the most widely supported way to collect violation reports.

Report To (report-to)

Names a group from a Reporting-Endpoints header - the modern replacement for report-uri.

Prefer sending it as a real HTTP response header - Copy header line above gives you the exact line to set in your web server / app framework config.
Can't set headers? A few directives (frame-ancestors, report-uri, report-to, and sandboxing) are ignored inside an HTML <meta> tag - the header is always the more complete option.
Turn on Report-Only first and watch your reporting endpoint / browser console for a few days before enforcing - a policy that's too strict silently breaks the page instead of erroring loudly.
Once quiet, switch off Report-Only so the policy actually blocks violations.

Everything happens in your browser - nothing you enter here is submitted to SYSBOX or anywhere else.