What is a Content Security Policy?

Content Security Policy (CSP) is an HTTP response header that instructs browsers to restrict which resources (scripts, styles, images, fonts, connections) a web page can load, providing a powerful defense against cross-site scripting (XSS) and data injection attacks.

What does script-src control in CSP?

The script-src directive specifies valid sources for JavaScript execution. It is the most critical CSP directive for XSS prevention, controlling both external script files and inline script blocks.

What is the difference between CSP and CORS?

CSP controls which resources your page can load (outbound restrictions enforced by the browser). CORS controls which origins can access your API (inbound access control enforced by the server). They serve complementary security purposes.

Should I use unsafe-inline in script-src?

No, in production environments. unsafe-inline allows any inline script to execute, which defeats the primary XSS protection benefit of CSP. Use nonce-based or hash-based script-src instead for required inline scripts.

What is Content-Security-Policy-Report-Only?

Report-Only mode sends the same CSP policy but monitors violations without blocking resources. It is ideal for testing new policies in production to identify required allowlist entries before switching to enforcing mode.

How does CSP prevent XSS attacks?

CSP blocks the browser from executing scripts that are not explicitly allowlisted in script-src. Even if an attacker injects a malicious script tag, the browser refuses to run it because the source is not permitted by the policy.

A nonce (number used once) is a random value generated per HTTP response and included in both the CSP script-src directive and matching inline script nonce attributes, allowing specific inline scripts while blocking all others.

What does default-src do?

default-src serves as a fallback directive for all fetch directives that are not explicitly defined. Setting default-src self provides a secure baseline, with specific directives overriding it where needed.

How do I add Google Analytics to my CSP?

Add https://www.googletagmanager.com and https://www.google-analytics.com to script-src, and https://www.google-analytics.com to connect-src and img-src for full Google Analytics and Tag Manager compatibility.

What is frame-ancestors used for?

frame-ancestors controls which websites can embed your page in iframes, preventing clickjacking attacks. Setting frame-ancestors none blocks all embedding, while self allows only same-origin framing.

Can CSP block inline event handlers like onclick?

Yes. A strict script-src without unsafe-inline blocks inline event handlers (onclick, onerror, onload). Refactor to external JavaScript event listeners or use nonce-based inline scripts instead.

What is the difference between CSP meta tag and HTTP header?

CSP can be delivered via HTTP response header (preferred, supports report-uri and all directives) or HTML meta tag (limited — no report-uri, frame-ancestors, or sandbox). HTTP headers are strongly recommended for production.

How do I deploy CSP on Nginx?

Add add_header Content-Security-Policy "your-policy-here"; to your Nginx server or location block configuration. Use the ScanSuite generator output and test with Report-Only mode first.

What is connect-src in CSP?

connect-src restricts URLs that can be loaded via fetch, XMLHttpRequest, WebSocket, EventSource, and navigator.sendBeacon. It prevents exfiltration of stolen data to attacker-controlled servers.

Does CSP protect against all XSS types?

CSP blocks most reflected and stored XSS by preventing unauthorized script execution. However, DOM-based XSS through unsafe JavaScript APIs (innerHTML, document.write, eval) requires additional input sanitization and code review.

What is style-src unsafe-inline needed for?

Many CSS-in-JS libraries and framework-generated styles require unsafe-inline in style-src. This is generally acceptable because CSS injection is less dangerous than script injection, though style-src self is preferred when possible.

How do I test my CSP policy before deploying?

Use Content-Security-Policy-Report-Only header to monitor violations without blocking resources. Check browser console for CSP errors, then use the Security Headers Checker to verify the deployed header on live URLs.

What is object-src none recommended for?

object-src none blocks all plugin content (Flash, Java applets, Silverlight). It is a recommended best practice even if your application does not use plugins, preventing legacy browser exploit vectors.

Can I use wildcards in CSP source expressions?

Yes, host-source wildcards like https://*.example.com are supported. However, avoid overly broad wildcards like https: or * which permit resources from any origin and weaken XSS protection significantly.

Is the ScanSuite CSP generator free to use?

Yes. ScanSuite provides unlimited free CSP policy generation with no registration required. All configuration happens client-side in your browser with instant policy preview and one-click copy.

Free Content Security Policy (CSP) Generator

A CSP generator is a web-based tool that helps developers construct Content Security Policy HTTP response headers by selecting and configuring directives such as script-src, style-src, connect-src, and frame-ancestors, producing syntactically valid policy strings that restrict resource loading and mitigate cross-site scripting (XSS) attacks.

Select directive categories (script-src, style-src, img-src, connect-src, frame-ancestors), add trusted source origins like self and https://cdn.example.com, toggle strict or loose preset modes, and copy the generated Content-Security-Policy header value for deployment in your web server, CDN, or application middleware configuration.

Cross-site scripting (XSS) remains one of the most prevalent web application vulnerabilities, allowing attackers to inject malicious JavaScript that steals session cookies, exfiltrates data, or performs unauthorized actions on behalf of authenticated users. Content Security Policy (CSP) is a browser-enforced defense mechanism defined in W3C standards that restricts which resources a web page can load and execute.

ScanSuite's free online CSP generator simplifies the complex process of building effective Content Security Policy headers. Instead of manually crafting semicolon-delimited directive strings and memorizing source expression syntax, developers use an intuitive interface to configure script-src, style-src, connect-src, img-src, font-src, frame-ancestors, and other directives with common source presets and custom domain entries.

ScanSuite's free online CSP generator builds Content Security Policy headers to prevent XSS attacks by configuring script-src, style-src, connect-src, frame-ancestors, and other directives through an intuitive visual interface. Apply strict or loose preset modes, add custom trusted origins, preview the generated policy in real time, and deploy the header on Nginx, Apache, Cloudflare, or application middleware for robust browser-enforced web security.

Frequently Asked Questions

What is a Content Security Policy?: Content Security Policy (CSP) is an HTTP response header that instructs browsers to restrict which resources (scripts, styles, images, fonts, connections) a web page can load, providing a powerful defense against cross-site scripting (XSS) and data injection attacks.
What does script-src control in CSP?: The script-src directive specifies valid sources for JavaScript execution. It is the most critical CSP directive for XSS prevention, controlling both external script files and inline script blocks.
What is the difference between CSP and CORS?: CSP controls which resources your page can load (outbound restrictions enforced by the browser). CORS controls which origins can access your API (inbound access control enforced by the server). They serve complementary security purposes.
Should I use unsafe-inline in script-src?: No, in production environments. unsafe-inline allows any inline script to execute, which defeats the primary XSS protection benefit of CSP. Use nonce-based or hash-based script-src instead for required inline scripts.
What is Content-Security-Policy-Report-Only?: Report-Only mode sends the same CSP policy but monitors violations without blocking resources. It is ideal for testing new policies in production to identify required allowlist entries before switching to enforcing mode.
How does CSP prevent XSS attacks?: CSP blocks the browser from executing scripts that are not explicitly allowlisted in script-src. Even if an attacker injects a malicious script tag, the browser refuses to run it because the source is not permitted by the policy.