Security headers builder
A CSP and modern header set for your host, every line explained.Check what your site loads. Get a CSP and a modern header set for your host, every line explained.
Why each line is there
Every source traces back to something you checked. Nothing is in there just in case.
| Directive | Source | Because |
|---|
The other headers
Common questions
Will this break my site?
It can if something your site loads isn't checked. That's why report-only mode is on by default: browsers log what would have been blocked without blocking it. Deploy it, watch the console or your report endpoint for a few days, add what's missing, then switch to enforcing.
Where do the third-party domains come from?
Each service's own CSP documentation, linked next to it. Stripe and Google's lists were checked in October 2026. Vendors change these lists, so if a service starts failing, check its doc link first.
Should I use nonces or 'unsafe-inline'?
Nonces, if you have a server or edge function that renders each response: a fresh random value per request means an injected script can't guess it. Static hosts serve the same bytes to everyone, so they can't do per-request nonces; there the honest options are no inline scripts, hashes, or 'unsafe-inline' with eyes open.
Why both frame-ancestors and X-Frame-Options?
frame-ancestors is the modern control and wins in every current browser. X-Frame-Options covers older ones. Sending both, set the same way, costs nothing.
Headers are the easy layer. Auth is the hard one. Identity, access control and secure architecture are the day job, including a patent-pending graph IAM system.
Talk to an engineerNew tools, when they ship. One email per tool.