Question 1

What is a Content Security Policy (CSP) header?

Accepted Answer

A Content Security Policy (CSP) header is an HTTP response header that tells the browser which sources of content are allowed to load on your page. It helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by restricting where scripts, styles, images, and other resources can come from.

Question 2

Is this CSP generator free to use?

Accepted Answer

Yes, NexTool's CSP Header Generator is completely free. It runs entirely in your browser with no server calls, no signup required, and no usage limits. Your policy configuration never leaves your device.

Question 3

Why should I avoid unsafe-inline and unsafe-eval in CSP?

Accepted Answer

Using 'unsafe-inline' allows any inline script or style to execute, which defeats the main purpose of CSP against XSS attacks. Similarly, 'unsafe-eval' permits eval() and similar functions that can execute arbitrary code. Both significantly weaken your security posture and should be avoided in production whenever possible.

Question 4

Can I use CSP in a meta tag?

Accepted Answer

Yes, you can use a <meta http-equiv="Content-Security-Policy"> tag in your HTML head. However, some directives like frame-ancestors, report-uri, and report-to are not supported in meta tags and must be delivered via HTTP headers. This tool shows you both options.

Free CSP Header Generator

Need something more powerful?

NexTool on GitHub