Practical CSP Creator

Do you use ...

Which of the following external services do you use in your website?
Advertising :
Google Adsense  
Analytics :
Fathom Analytics   Google Analytics   Hotjar   Simple Analytics  
Bootstrap :
Bootstrap CDN  
Fonts :
Font Awesome   Google Fonts   Ion Icons  
JS :
ASPNet CDN   CDN JS   Google API   JSdelivr   NPM Unpkg  
Jquery :
Jquery CDN  
Media :
Youtube  
Payment :
Braintree   Stripe  
Social :
Facebook Share   LinkedIn Share   ShareThis   Twitter Share  

CSP header for these services

Content-Security-Policy: default-src 'self' 'unsafe-inline';

How to set a response header in code

Django (Python)
response['Content-Security-Policy'] = content_security_policy
Flask(Python)
resp.headers['Content-Security-Policy'] = content_security_policy
Java
HttpServletResponse.setHeader('Content-Security-Policy', content_security_policy)
Laravel (PHP)
response($response)->header("Content-Security-Policy", $content_security_policy);
Node JS
response.setHeader('Content-Security-Policy', content_security_policy);
PHP
header("Content-Security-Policy: $content_security_policy");
Rails (Ruby)
response.set_header('Content-Security-Policy', content_security_policy)
Symfony (PHP)
$response->headers->set('Content-Security-Policy',$content_security_policy);

Custom CSP Header

  • Use the detailed CSP generator on report-uri.io
  • Use Google's Content Security Policy Evaluator