--- title: "Free CSP Chrome extension: build & test, no deploy" description: "Free Chrome extension: stream live CSP violations, swap in a policy in Report-Only or Enforce, and build a strict header against real pages. No deploy." url: "https://centralcsp.com/en/tools/extension/" lang: "en" --- Tools # Build CSP right in your browser. Watch live CSP violations, rewrite the policy on the fly, or auto-build a strict header, against real production pages, with no deploys. [Add to Chrome](https://chromewebstore.google.com/detail/centralcsp/pjalkmmdpdgoemhpghbjkgnphehfejof) [See continuous CSP monitoring](https://centralcsp.com/en/platform/monitoring/) 5.0 600+ users on the Chrome Web Store Rec Clear Off Observe Rewrite Build Filter reports, directive, source, document… Build mode Strict report-only base. Violations are processed and your policy is built while you navigate. listening · 1 page · 244 reports Reports last 30s · by directive 30s 1m 5m 103 60 30 0 \-30s now Time Directive Blocked source 18:46:17 style-src-attr inline 18:46:15 style-src-attr inline 18:46:15 connect-src https://www.googletagmanager.com 18:46:13 style-src-attr inline 18:46:11 style-src-attr inline 18:46:11 connect-src https://www.googletagmanager.com 18:46:09 style-src-attr inline 18:46:07 style-src-attr inline 18:46:07 connect-src https://www.googletagmanager.com 18:46:05 style-src-attr inline 18:46:03 connect-src https://www.googletagmanager.com frame-src report 18:44:39 Parsed effective directive frame-src blocked uri https://www.youtube.com document uri https://shop.acme.com/checkout disposition report type csp-violation Raw JSON { "body": { "blockedURL": "https://www.youtube.com", "disposition": "report", "documentURL": "https://shop.acme.com/checkout", "effectiveDirective": "frame-src", "sample": "", "statusCode": 200 }, "id": "37afb202-d570-4b63-9091-2381d4897594", "origin": "https://shop.acme.com", "type": "csp-violation" } Current policy build Pretty Raw default-src 'none' ; script-src 'report-sample' 'report-sha256' ; script-src-elem 'self' 'unsafe-inline' https://cdn.acme.com ; script-src-attr 'none' ; style-src 'none' ; style-src-elem 'self' 'unsafe-inline' ; img-src 'self' data: ; font-src 'self' ; connect-src 'self' https://www.googletagmanager.com ; frame-src https://www.youtube.com ; object-src 'none' ; base-uri 'none' ; form-action 'none' ; frame-ancestors 'none' ; ## One extension, three ways to work a Content Security Policy. Pick the mode that matches where you are, from watching what breaks to shipping a locked-down header. ### Observe Stream every violation from the site's existing CSP into the popup and DevTools panel, mapped line by line to the policy that broke, without changing a thing. ### Rewrite Swap in your candidate policy on the fly. Choose Enforce or Report-Only, Replace or Append, reload, and watch violations stream in as parsed and raw JSON. ### Build Start from a strict report-only base, browse the site normally, and let the extension classify violations by directive and assemble a working policy from real page loads. ## See the extension in action. Two minutes: switching a live page into Build mode, violations arriving classified by directive, and the assembled header copied out ready to paste. The loop ## A five-second feedback loop. Edit the policy, reload, and see exactly what breaks, against the real page and its real third-parties. No staging, no deploy. ### install One click from the Chrome Web Store, on Chrome, Edge, Brave and Arc. The extension stays inactive until you switch it on for a site. ### pick a mode Choose Observe, Rewrite, or Build depending on whether you're watching, testing, or authoring. ### iterate Edit the policy and reload. Each pass gives you five-second feedback against real third-parties. ### ship Ship it as Content-Security-Policy-Report-Only first, watch the reports, then switch the header to Content-Security-Policy. Alternatives ## Three ways people test a policy. The other two work. Neither gives you all four at once. Ways to test a Content Security Policy compared | | This extension | A header editor | Report-Only on staging | | --- | --- | --- | --- | | Sees real violations | Streamed as they fire | No violation view | Only staging traffic | | Keeps the policy enforced | Enforce or Report-Only | Whatever you set | Report-Only blocks nothing | | Builds a policy for you | From real page loads | You write it | From collected reports | | Works without a deploy | No server change | Needs a server change | A deploy per iteration | ## Everything you need to get a policy right. A full CSP toolkit in the toolbar, from live rewriting to a copy-ready header. ### Rewrite live headers Replace or append the CSP on any response, in Enforce or Report-Only, without touching the server. ### Live DevTools panel A panel in DevTools streams every violation the instant it fires, classified by directive, with the parsed report and the raw JSON side by side. ### Auto-build policies Turn observed traffic into a strict policy, classified by directive and grounded in real page loads. ### Copy-ready headers Generate a clean, deploy-ready Content-Security-Policy header you can paste straight into your config. ### Fully local No accounts, no telemetry, no outbound calls. Everything runs and stays inside your browser. ### Works on production Test against the real page and its real third-parties. A CSP you can't test against the real page is a guess. Beyond the browser ## The extension builds the policy. The platform keeps it honest. The extension is a single local session in one browser, so it cannot see what other visitors' browsers report. That is what continuous collection is for: author in the browser, then monitor the same policy in production around the clock. ### From one-off testing to continuous protection The extension is where you author and debug. The CentralCSP platform then watches that policy in production, around the clock, across every visitor's browser. [Start free trial](https://app.centralcsp.com) ![The continuous monitoring dashboard: CSP reports collected from your real visitors' browsers, charted over time.](https://centralcsp.com/assets/hero-monitoring-D_dlU4gK.webp) ### Continuous collection 24/7 CSP report collection from your real users' browsers, not a single local session. ### Script inventory Every script on every page, fingerprinted with SHA-256/384/512 hashes and checked for known CVEs. ### Alerts and PCI evidence Real-time Slack and webhook alerts on new origins and scripts, plus auditor-ready PCI DSS v4 evidence. Further reading ## Build the policy, then keep it honest Reading violations, choosing report-only or enforce, and the workflow the extension is a step in. - [Read the extension walkthrough](https://centralcsp.com/en/blog/centralcsp-chrome-extension) - [How to debug CSP violations in Chrome DevTools](https://centralcsp.com/en/blog/debug-csp-violations-devtools) - [CSP enforce vs report-only, when to use each](https://centralcsp.com/en/blog/csp-enforce-vs-report-only) - [How to read a CSP violation report](https://centralcsp.com/en/blog/csp-violation-report-fields) - [The full workflow for building a strong CSP](https://centralcsp.com/en/blog/how-to-build-a-strong-csp) - [Content-Security-Policy-Report-Only reference](https://centralcsp.com/en/docs/web-security/policies/content-security-policy/report-only) More free tools ## Keep auditing with the other free tools Every tool is free, runs without an account, and scores with the same severity scale. ### CSP scanner Fetch a URL's live Content-Security-Policy and score it against known bypasses, wildcard sources and missing directives. - Directive-level findings - Shareable results link [Run the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/) ### CSP evaluator Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required. - Audit before you ship - Same scoring engine [Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) ### Security headers scanner Grade every security header a URL sends, from HSTS to Permissions-Policy, with each finding explained and prioritized. - Every header, one grade - Fix list ordered by impact [Scan your security headers](https://centralcsp.com/en/tools/security-headers/) ### Reporting API checker Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report. - Endpoint and feature mapping - Silent drops flagged [Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/) ### SRI hash generator Turn a CDN script or stylesheet URL into its Subresource Integrity hash, with a ready-to-paste tag and a CORS check. - SHA-256, 384 and 512 - CORS verified for you [Generate an SRI hash](https://centralcsp.com/en/tools/sri-hash/) ### CSP hash generator Turn an inline script or style into the hash that lets it run under a strict policy, right in your browser. - Runs entirely client-side - SHA-256, 384 and 512 [Generate a CSP hash](https://centralcsp.com/en/tools/csp-hash/) FAQ ## Extension questions, answered The essentials on installing, privacy, and how the extension fits with the platform. ### Is the extension free? Yes. It's completely free, with no signup and no account required. Install it from the Chrome Web Store and start working a policy right away. ### Does the extension send my data anywhere? The extension makes no calls of its own: no accounts, no telemetry, and nothing is ever sent to us. Violation reports go only where the policy you apply tells the browser to send them, so if it names a reporting endpoint the browser posts them there, and if it names none they stay in your browser. ### Which browsers are supported? It's built for Chrome and Chromium-based browsers such as Edge, Brave, and Arc, and installs in one click from the Chrome Web Store. ### How is the extension different from the CentralCSP platform? The extension is a local workbench for authoring and debugging a policy by hand. The platform continuously monitors your policy in production from real browser traffic, inventories every script, alerts your team, and exports PCI DSS v4 evidence. ### Do I need to deploy anything to test a policy? No, that's the point. You rewrite headers in the browser and test against the real production page and its real third-parties, with no staging environment and no server deploys. ### Does the extension disable my CSP? No, and that is the difference between it and the disable-CSP extensions people usually reach for. Off leaves the page exactly as the server sent it. Rewrite replaces or appends a policy you chose, in Enforce or Report-Only, so the page is running under a policy at all times. The rewrite is local to your browser: your server keeps sending the header it always sent, and every other visitor loads the real site untouched. ### Can I test a Report-Only policy? Yes. Rewrite mode has two toggles: Enforce or Report-Only, and Replace or Append. Report-Only lets you see everything a candidate policy would block without breaking the page, which is how you check a strict policy against production before committing to it. Append keeps the site's existing policy and adds yours on top, which is useful when you are tightening rather than replacing. ### Can it build a policy for me? Yes. Build mode starts from a strict report-only base and assembles the directives from real page loads as you browse: each script, style and connection the page actually makes becomes a source in the right directive, classified as it arrives. You browse the flows you care about, then copy out the assembled header. It is the same idea as building from production reports, scoped to one browser session. ## Start building your CSP in the browser. Add the extension in one click. It's free, local, and needs no signup. Rated 5.0 by 600+ users on the Chrome Web Store. [Add to Chrome](https://chromewebstore.google.com/detail/centralcsp/pjalkmmdpdgoemhpghbjkgnphehfejof) [Collect reports from real visitors](https://centralcsp.com/en/platform/monitoring/) Rec Clear Off Observe Rewrite Build Filter reports, directive, source, document… Build mode Strict report-only base. Violations are processed and your policy is built while you navigate. listening · 1 page · 244 reports Reports last 30s · by directive 30s 1m 5m 103 60 30 0 \-30s now Time Directive Blocked source 18:46:17 style-src-attr inline 18:46:15 style-src-attr inline 18:46:15 connect-src https://www.googletagmanager.com 18:46:13 style-src-attr inline 18:46:11 style-src-attr inline 18:46:11 connect-src https://www.googletagmanager.com 18:46:09 style-src-attr inline 18:46:07 style-src-attr inline 18:46:07 connect-src https://www.googletagmanager.com 18:46:05 style-src-attr inline 18:46:03 connect-src https://www.googletagmanager.com frame-src report 18:44:39 Parsed effective directive frame-src blocked uri https://www.youtube.com document uri https://shop.acme.com/checkout disposition report type csp-violation Raw JSON { "body": { "blockedURL": "https://www.youtube.com", "disposition": "report", "documentURL": "https://shop.acme.com/checkout", "effectiveDirective": "frame-src", "sample": "", "statusCode": 200 }, "id": "37afb202-d570-4b63-9091-2381d4897594", "origin": "https://shop.acme.com", "type": "csp-violation" } Current policy build Pretty Raw default-src 'none' ; script-src 'report-sample' 'report-sha256' ; script-src-elem 'self' 'unsafe-inline' https://cdn.acme.com ; script-src-attr 'none' ; style-src 'none' ; style-src-elem 'self' 'unsafe-inline' ; img-src 'self' data: ; font-src 'self' ; connect-src 'self' https://www.googletagmanager.com ; frame-src https://www.youtube.com ; object-src 'none' ; base-uri 'none' ; form-action 'none' ; frame-ancestors 'none' ; --- Available in: [en](https://centralcsp.com/en/tools/extension/), [fr](https://centralcsp.com/fr/tools/extension/)