Policy Generator

Build security policy headers interactively. Generate CSP, CORS, HSTS, and other headers ready for deployment on Apache, Nginx, or your application server.

🔒 Content-Security-Policy CSP

Preset

default-src

script-src

style-src

img-src

connect-src

font-src

frame-ancestors

base-uri

form-action

upgrade-insecure-requests

block-all-mixed-content

🌐 CORS Cross-Origin

Access-Control-Allow-Origin

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Max-Age (seconds)

Allow credentials

Expose headers (X-Request-Id, X-Total-Count)

🛡️ Other Security Headers

Strict-Transport-Security HSTS

X-Frame-Options

X-Content-Type-Options

Referrer-Policy

Permissions-Policy

Output format

# Configure the options above to generate security headers

What is Policy Generator?

Generate CSP, CORS, and HSTS security policies for Apache, Nginx, and Express. Copy-paste ready configuration files.

FAQ

What policy should I start with?: Start with a report-only CSP to see what would be blocked without breaking your site. Then move to enforcing mode.
What is strict-dynamic?: strict-dynamic allows scripts loaded by trusted scripts to also execute. It's the modern way to handle inline scripts in CSP.

Policy Generator

🔒 Content-Security-Policy CSP

🌐 CORS Cross-Origin

🛡️ Other Security Headers

What is Policy Generator?

FAQ

Related Tools