🧱
CSP 建構器
Interactive" data-tooltip="Edit directives and instantly see the full header value." cursor-help> Interactive產生 Content Security Policy 標頭。
- Security Checks
Tip: Use Report-Only to test safely in production.
Warnings
No warnings yet.
Directives
Space-separated sourcesFallback for most fetches
JS sources (use nonce/hash, avoid unsafe-inline)
CSS sources (consider hashes/nonces)
Images
XHR/fetch/WebSocket
Fonts
Frames/iframes
Plugins (usually 'none')
Restrict
Where forms can POST
Who can embed you
This tool does not validate your site behavior — always test in a staging environment.
Baseline recommendations
object-src 'none'— blocks plugin contentbase-uri 'none'— prevents base tag injectionframe-ancestors 'none'— prevents clickjacking (or set to allowed origins)- Prefer nonces/hashes over
'unsafe-inline'for scripts/styles
Report-Only
Report-Only lets you monitor policy violations without blocking content. Use it to roll out a strict policy safely.