# Overview (/en/docs/platform/features/csp-builder)





The CSP builder writes a [Content Security Policy (CSP)](/en/docs/web-security/policies/content-security-policy) from your own CSP reports. You pick the reports to learn from, start from your current policy or from the CentralCSP baseline, decide which reported sources to allow, and copy the headers.

The builder lives under each website, in the sidebar, as **Builders** > **Content-Security-Policy**. Every website role can use it.

<Callout type="info">
  The builder reads CSP violation reports, so it needs a plan that collects them. On other plans the page shows **The CSP builder is not in your plan**. [Compare plans](/pricing), or go to **Settings** > **Billing** to change yours.
</Callout>

<Callout type="warn" title="Review every value, and deploy in report-only first">
  The builder suggests values from what browsers reported, and its defaults keep everything your pages load today, including risky values and scripts you may not recognize. Review the values before you deploy a new policy, starting with the risk flags and the script sources you do not know. A policy from the API or the MCP tool applies the same defaults with no review, so check it the same way.

  Always deploy a new policy with the `Content-Security-Policy-Report-Only` header first. Switch to `Content-Security-Policy` only once a week or more of reports shows that nothing your pages need would be blocked.
</Callout>

## What the CSP builder produces [#what-the-csp-builder-produces]

The builder ends with two response headers, ready to paste into your server or content delivery network (CDN) configuration. A [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints) header points reports at your website's CentralCSP endpoint. A [`Content-Security-Policy-Report-Only`](/en/docs/web-security/policies/content-security-policy/report-only) header carries the policy, or `Content-Security-Policy` once you switch to enforce mode.

Before you copy them, the builder grades the policy with the same analysis as the [CSP evaluator](/en/docs/platform/tools/csp-evaluator). Every risky value carries a severity in the review table, so you see what a value costs before you allow it.

The builder does not save or deploy anything. It gives you the headers, and you add them to your site. Each TXT export is recorded in the [audit log](/en/docs/platform/security/audit-log).

## How it works [#how-it-works]

The builder works in four steps. Each step reuses the answer of the one before it.

1. **Period**: Choose which days of reports to learn from, up to the last 30.
2. **Starting policy**: Start from the policy your site already sends, as the builder detected it in the reports, or from the CentralCSP baseline.
3. **Review sources**: Add or reject each value. Every source browsers reported starts decided for you, and noise such as browser extensions starts rejected.
4. **Deploy**: Pick report-only or enforce mode, copy the headers, and read the grade.

The defaults keep what your pages load today. A reported value stays added even when it weakens the policy. The builder flags it and tells you how to remove it later instead.

<img alt="The CSP builder on the Period step, with 7 days selected, the report chart, and the Reports, Sources found, and Look like noise counters" src="__img0" width="1519" height="588" />

## Where the data comes from [#where-the-data-comes-from]

The builder reads the [CSP violation reports](/en/docs/web-security/reporting-api/reports/csp-violation) your website already collects. Every blocked or reported resource becomes a value you can allow in its directive. A host becomes its origin, your own site becomes [`'self'`](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), and blocked inline code or `eval()` becomes the keyword that would allow it.

The reports also show which policies your site serves. The builder lists up to six of them as starting points, and marks the one it believes is live.

For how the builder picks values, flags noise, and detects your policy, refer to [Builder decision rules](/en/docs/platform/features/csp-builder/how-it-decides).

## Use it from the API and the MCP server [#use-it-from-the-api-and-the-mcp-server]

The REST API builds the same policy without the wizard. The **Build a recommended CSP** endpoint takes an optional period and an optional starting policy, and returns the policy as a header value, ready to send with a `Reporting-Endpoints` header. It applies the same defaults as the dashboard, with every non-noise source added and noise left out. Refer to the [API reference](/en/docs/api-mcp/api).

The [Model Context Protocol (MCP) server](/en/docs/api-mcp/mcp) exposes that endpoint as the `build_recommended_csp` tool. An AI client can build a policy and then grade it with `analyze_csp_policy`.

## Next steps [#next-steps]

* [Get started](/en/docs/platform/features/csp-builder/get-started)
* [Review table](/en/docs/platform/features/csp-builder/review-sources)
* [Nonces and unsafe-inline](/en/docs/platform/features/csp-builder/nonces-and-unsafe-inline)
* [Builder decision rules](/en/docs/platform/features/csp-builder/how-it-decides)
* [Connect your site](/en/docs/platform/websites/connect-your-site)
* [CSP violations](/en/docs/platform/monitoring/csp)