CSP Generator
Generate Content Security Policy headers.
Generated CSP Header
default-src 'self'; script-src 'self' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; media-src 'self'; worker-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'The default policy for fetching resources. Serves as a fallback for other fetch directives.
script-src
https://www.googletagmanager.com
style-src
img-src
data:
connect-src
font-src
object-src
media-src
worker-src
base-uri
form-action
frame-ancestors
About Content Security Policy (CSP)
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.
How it Works
You configure a CSP by specifying which domains the browser should consider to be valid sources of executable scripts. A CSP compatible browser will then only execute scripts loaded in source files received from those allowed domains, ignoring all other scripts.