Free tool
Content-Security-Policy builder
Describe your site — which third parties it loads, whether inline code exists, who may embed it — and get a copy-paste CSP header, with a plain-spoken warning whenever a choice quietly defeats the policy. Everything runs locally; nothing you enter leaves this page.
Deploying without breaking your site
The failure mode of CSP is not "too weak" — it's the policy that broke checkout on launch day and got deleted by lunchtime. Ship it in three moves: deploy as Report-Only with a report endpoint, let real traffic surface every origin you forgot, then flip to enforcing once the reports go quiet.
And treat the policy as living config, not a launch artifact: every new marketing tag, widget, or SDK is a policy change. The strongest CSPs belong to teams that find out the same day a header weakens — not at the next annual review.
Questions
What does a Content-Security-Policy header do?
It tells the browser which origins may supply scripts, styles, images, frames and connections for your page, and blocks everything else. Its main job is limiting what cross-site scripting can achieve: injected code that isn't allowed by the policy simply doesn't run.
Why is 'unsafe-inline' in script-src such a problem?
XSS is usually injected as inline script. A policy that allows inline scripts allows the attack it exists to stop — you keep the maintenance cost of CSP and lose most of the benefit. The modern fix is nonces: each response carries a random value, and only script tags stamped with it run.
Should I start with Report-Only?
Yes — deploy the policy as Content-Security-Policy-Report-Only with a report endpoint first. The browser reports violations without blocking anything, so you find the forgotten third-party widget before your users do. Once the reports go quiet, switch to the enforcing header.
Can I ship CSP in a meta tag instead of a header?
You can, with limits: frame-ancestors, report-uri and Report-Only mode only work as an HTTP header, and a meta policy only protects content after the tag is parsed. Use the meta tag when you genuinely cannot set headers (static hosting you don't control); otherwise prefer the header.
Checked once. Now have it watched.
Bastion checks the security headers on every scan — CSP present, clickjacking protection, HSTS and the rest — and alerts you when a deploy quietly drops or weakens one.
7-day trial of the full product, no card required. Scanning needs domain ownership verified by DNS — Bastion never scans anything you haven't proved you control.