Content-Security-Policy generator
Build a CSP header with its directives for Nginx, Apache or a meta tag.
Frequently asked questions
What's the difference with Report-Only?
With Content-Security-Policy-Report-Only the browser blocks nothing and only reports what it would have blocked. It's the safe way to test a policy before enforcing it.
Why doesn't frame-ancestors work in the meta tag?
Because frame-ancestors, report-uri and sandbox only apply when sent as an HTTP header; browsers ignore them in <meta>.
Is Content-Security-Policy generator free to use on Toolkoa?
Yes, the Content-Security-Policy generator tool is 100% free, unlimited and requires no sign up or installation.
Are my files sent to any server when using Content-Security-Policy generator?
No. Every operation on Toolkoa is processed privately and locally, directly in your own browser.
Do I need to install anything to use Content-Security-Policy generator?
Nothing to install. Content-Security-Policy generator runs in any modern desktop or mobile browser, and once the page has loaded you can keep using it without relying on the connection.