.htaccess & Nginx Redirect Generator
Convert old-to-new URL mappings into Apache .htaccess or Nginx redirect rules.
Generate RulesDeveloper Tools
CSP Header Builder & Validator
Build and inspect a Content-Security-Policy header with common directives and safe defaults. The interface provides a focused workflow, clear output and export or copy…
Input and options
Build and inspect a Content-Security-Policy header with common directives and safe defaults.
Privacy: Your input is processed in the browser where supported and is not intentionally stored by this tool.
Result
Your output
Add the required input and run the tool.
Simple controlsEverything you need for the task.
Clear resultsReview your output before using it.
No signupGet started without an account.
How it works
1. Add the Required Input
The code, structured data, expression, token, or sample value requested by the interface.
2. Review CSP Header Builder & Validator Options
Choose only the settings that apply to the result you need; leave optional controls unchanged when you are unsure.
3. Run the Validation
Start the task and wait for the interface to return its result or a clear setup message.
4. Verify Before You Use It
Test the result in a non-production environment. Never paste passwords, private keys, live access tokens or confidential production data.
Related Developer Tools
View All Developer Tools →Responsive Image srcset Generator
Create responsive srcset, sizes and picture markup from image filenames and width variants.
Generate MarkupSRI Hash Generator
Generate SHA-256, SHA-384 or SHA-512 Subresource Integrity values for a local file or public asset.
Generate SRIPermissions-Policy Header Generator
Build a Permissions-Policy header for browser capabilities such as camera, microphone and geolocation.
Generate HeaderPWA Manifest Generator & Validator
Create and validate a web app manifest with names, icons, display mode, colours and start URL.
Build ManifestFrequently Asked Questions
The code, structured data, expression, token, or sample value requested by the interface. Start with a representative input and use only the options needed for your intended result.
A transformed, generated, or diagnostic result for the submitted technical input. A clean automated check does not replace testing in the system where the data or code will be used.
Test the result in a non-production environment. Never paste passwords, private keys, live access tokens or confidential production data.
Processing stays in the browser where the individual feature supports it. Live public checks use a protected, rate-limited site endpoint; avoid unnecessary sensitive data.
The page can be used without creating a visitor account. Your browser or device may limit unusually large files or demanding media jobs.
About CSP Header Builder & Validator
CSP Header Builder & Validator brings the required input, options and result into one focused workflow. Build and inspect a Content-Security-Policy header with common directives and safe defaults. The result changes when the source data or selected options change, so it is easy to run a second comparison.
What to prepare
The code, structured data, expression, token, or sample value requested by the interface.
What the result represents
A transformed, generated, or diagnostic result for the submitted technical input.
A practical example
It can help when you need to inspect a small representative sample before applying the same change in a production workflow. Start with a representative input, inspect the first result, then adjust one setting at a time if you need a different outcome.
- Checking data during development with CSP Header Builder & Validator.
- Preparing a value for testing with CSP Header Builder & Validator.
- Spotting formatting or validation problems before release with CSP Header Builder & Validator.
Before you use the result
- Test the result in a non-production environment. Never paste passwords, private keys, live access tokens or confidential production data.
- A clean automated check does not replace testing in the system where the data or code will be used.
Privacy and processing
Processing stays in the browser where the individual feature supports it. Live public checks use a protected, rate-limited site endpoint; avoid unnecessary sensitive data.