About this utility
How to use Content Security Policy Builder
Build a conservative CSP header from explicit source lists and explain major protections before deployment.
What to provide
Optional note stays in this tab. Enter source expressions in the controls below.
- Enter the optional value described above, or leave it empty to generate new values.
- Choose the options that match your intended result.
- Select “Run tool” or press Ctrl/Command + Enter, then copy, download, or move the result back into the first input for another pass.
What the result means
A deployable CSP header, parsed directives, and security warnings.
Privacy and safety
This utility is loaded as browser code and processes your input only in this tab. OmniCastConverter has no upload endpoint and never stores your content, filenames, tokens, or secrets. Generated markup and code are shown as inert text and are never executed.
Limitations
- Deploy in Report-Only mode first. Nonces, hashes, Trusted Types, reporting endpoints, frames, workers, and application-specific third parties need deliberate integration.
Try the included example
Select “Load example” at any time to restore this tested sample.
(choose a local file)