# CSP Policy Builder

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/csp-builder/
Language: en
Alternate: https://jmrp.io/es/tools/csp-builder/index.md
Updated: 2026-09-03
License: https://jmrp.io/license/
Category: security
Tags: csp, security, headers, xss, nginx

Build Content Security Policy headers interactively. Toggle directives, see the policy generated live, and get a security rating. Runs client-side.
Build-Date: 2026-09-06

Features:
- Toggle 20+ CSP directives by category
- Quick presets for common third-party services
- Export to 7 server formats (Nginx, Apache, Vercel)
- Report-Only mode and live security assessment
- Runs entirely in your browser

Questions answered:

**What is a Content Security Policy and why do I need one?**

A Content Security Policy (CSP) is an HTTP response header that tells the browser which sources of content are trusted, helping detect and mitigate attacks like Cross-Site Scripting (XSS) and data injection. It is a critical defense-in-depth layer for any modern website.

**Is my CSP configuration sent to a server?**

No. All policy building and formatting happens entirely in your browser. No domains, URLs, or policy settings ever leave your device.

**Which server formats can I export to?**

The builder generates ready-to-use configuration in 7 formats, including Nginx, Apache, Cloudflare, and Vercel. Select your server and copy the output directly into your configuration.

**What does Report-Only mode do?**

Report-Only mode lets you test a policy without actually blocking any resources. The browser reports violations it would have blocked, so you can refine your CSP safely before enforcing it.

**Why does the tool warn about 'unsafe-inline'?**

The security assessment flags insecure configurations like 'unsafe-inline' because they weaken your policy by allowing inline scripts or styles, defeating much of CSP's protection against XSS. Prefer nonces or hashes instead.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## About This Tool

Content Security Policy (CSP) is a critical security layer that helps detect
and mitigate certain types of attacks, including Cross-Site Scripting (XSS)
and data injection attacks. This interactive builder helps you construct
complex CSP headers by selecting directives and adding trusted sources.

### Features

- **20+ directives** organized by category (Fetch, Navigation, Document, etc.)
- **Quick presets** for common services like Google Fonts, Analytics, YouTube, and CDNs
- **Custom domains** — add your own trusted URLs to any directive
- **7 export formats** — ready-to-use config for Nginx, Apache, Cloudflare, Vercel, and more
- **Report-Only mode** — test your policy without blocking resources
- **Security assessment** — real-time warnings for insecure configurations like `'unsafe-inline'`

### How do I use this tool?

1. Enable the directives you need for your website
2. Use quick presets to add common third-party services
3. Add custom domains by clicking the **+** button on editable directives
4. Select your server format (Nginx, Apache, Cloudflare, etc.)
5. Enable **Report-Only mode** to test before enforcing
6. Copy and add to your server configuration

### Privacy

Your security configurations are private. All policy building and formatting
happens entirely in your browser. No domains, URLs, or policy settings are
sent to any server.

### Linux Command Reference

Once you've configured your CSP, you can verify it using terminal tools.

#### How do I check the CSP header with curl?

```bash
curl -I https://jmrp.io | grep -i "content-security-policy"
```

**CSP Header Output**

```text
content-security-policy: default-src 'self'; script-src 'self' ...
```

#### How do I calculate the hash for an inline script?

```bash
echo -n 'alert("Hello");' | openssl dgst -sha256 -binary | openssl base64
```

**Output — Base64 Hash**

```text
qznLcsROU4CHAtWia...
```

### Learn More

For a complete guide on implementing CSP, see [Implementing Content Security Policy in Nginx](https://jmrp.io/blog/003-implementing-content-security-policy-nginx/).