Build a conservative starter Content-Security-Policy or Report-Only response header from simple source allowlists.
What this CSP generator includes
The starter policy uses default-src 'self', keeps scripts and styles same-origin unless you add sources, blocks plugins with object-src 'none', limits base-uri and form-action to the same origin, and lets you control frame-ancestors.
A CSP can break scripts, styles, images, fonts, API calls or embedded content when required sources are missing. Start with Content-Security-Policy-Report-Only, observe violations, then deploy an enforcing header after testing. Sites that use inline scripts or styles often need nonces or hashes; this starter tool intentionally does not add 'unsafe-inline' or 'unsafe-eval'.
Source syntax notes
Additional-source fields accept a conservative subset such as https://cdn.example.com, https:, wss://socket.example.com, *.example.com, data: and blob:. Advanced CSP source expressions should be reviewed against the current specification before deployment.
Reference: MDN Content-Security-Policy header reference.