CSP Builder

Draft a Content-Security-Policy header from a static, WordPress, or Shopify preset. This page does not publish the header.

Preset

Extra script hostsOptional. Added to script-src. Check the live page before you publish.

Site to check afterward

This text is a draft. It does not change the live site until you publish the header on your server or CDN.

Draft record

default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; upgrade-insecure-requests

Check the live CSP after you publish the draft yourself. These builders do not publish DNS, do not change headers, and do not start Mail Watch.