Build Access-Control-Allow-Origin, Methods, Headers, Max-Age and Credentials response headers.
CSP Header Builder
Runs locally
Use CSP Header Builder
What it does
Assemble a Content-Security-Policy header from 13 directives, from default-src and script-src to form-action and frame-ancestors, by ticking each one and entering its sources.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Strict starter policy
Keep default-src 'self'; tick script-src with 'self', object-src with 'none' and frame-ancestors with 'none'Content-Security-Policy: default-src 'self'Gives Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'. Try it as Content-Security-Policy-Report-Only first.
FAQ
Which directives help against phishing and injection?
form-action limits where forms may post, so an injected login form cannot send credentials to another host. frame-ancestors 'none' stops other sites from framing your login page, and script-src without 'unsafe-inline' blocks most injected scripts.
Does the builder check my policy?
No. Values are copied as typed, so keywords must keep their quotes ('self', 'none'), because an unquoted self is read as a host name. report-to and upgrade-insecure-requests are not offered, and frame-ancestors only works in the HTTP header, not in a meta tag.
Is anything uploaded?
No. The header is assembled in your browser and nothing is sent anywhere.