CSP Builder

What the CSP Builder does

The CSP Builder reads the existing Content-Security-Policy header from your scan target (if any), parses each directive, scores your policy from 0–100, and provides an interactive editor where you can add, remove, or adjust directives and preview the resulting header string in real time.

To open the CSP Builder: run a vulnerability scan, then click CSP Builder in the scan results toolbar — or open it from Tools → CSP Builder in the navigation.

Why CSP matters

Content Security Policy is the single most effective browser-enforced defence against Cross-Site Scripting (XSS). A well-configured CSP blocks injected scripts from executing even if an XSS vulnerability exists. Without a CSP, an attacker who finds one XSS can steal session cookies, redirect users, or silently exfiltrate data.

CSP score

The score (0–100) is calculated from the following criteria:

Directive reference

Common mistakes

Using 'unsafe-inline'

Allows any inline script to execute — completely defeats XSS protection. Replace inline scripts with external files or use a per-request nonce: generate a random value server-side, set it in the Content-Security-Policy header as 'nonce-BASE64VALUE', and add nonce="BASE64VALUE" to every <script> tag.

Missing frame-ancestors

X-Frame-Options is the legacy way to prevent clickjacking. frame-ancestors is the modern CSP equivalent, more flexible, and takes precedence when both are set. Always include frame-ancestors 'none' (or 'self' if you embed your own site).

Wildcards in default-src

default-src * allows loading resources from any origin — equivalent to having no policy. Always use explicit origins or 'self' as the fallback.

Copying your CSP

After editing in the CSP Builder, click Copy Header to copy the full header string ready to paste into your web server config:

add_header Content-Security-Policy
  "default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'; base-uri 'self';"
  always;