# CSP Header Builder

URL: https://phishdestroy.io/developer-tools/csp-header-builder
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Assemble a Content-Security-Policy header from 13 directives, from default-src and script-src to form-action and frame-ancestors, by ticking each one and entering its sources.

## Example input

Strict starter policy

```
Keep default-src 'self'; tick script-src with 'self', object-src with 'none' and frame-ancestors with 'none'
```

Gives Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'. Try it as Content-Security-Policy-Report-Only first.

## FAQ

### Which directives help against phishing and injection?

form-action limits where forms may post, so an injected login form cannot send credentials to another host. frame-ancestors 'none' stops other sites from framing your login page, and script-src without 'unsafe-inline' blocks most injected scripts.

### Does the builder check my policy?

No. Values are copied as typed, so keywords must keep their quotes ('self', 'none'), because an unquoted self is read as a host name. report-to and upgrade-insecure-requests are not offered, and frame-ancestors only works in the HTTP header, not in a meta tag.

### Is anything uploaded?

No. The header is assembled in your browser and nothing is sent anywhere.

## Related tools

- [CORS Headers Generator](https://phishdestroy.io/developer-tools/cors-headers-generator)
- [HTTP Headers Reference](https://phishdestroy.io/developer-tools/http-headers-reference)
- [Apache .htaccess Snippets](https://phishdestroy.io/developer-tools/htaccess-snippets)
- [HTML Escape / Unescape](https://phishdestroy.io/developer-tools/html-entity-encoder)
- [security.txt Generator](https://phishdestroy.io/developer-tools/security-txt-generator)

All tools: https://phishdestroy.io/developer-tools