Content Security Policy Builder
Build, optimize, and maintain your Content Security Policy with our automated policy builder. No expertise required.
Start with your existing policy
Smart policy discovery
Our system automatically detects the policies used by your application and generate a new policy based on the existing one.
- Automatic policy detection
- Works with custom policies
- Easy to use and understand
What is the CSP Builder?
The CSP Builder is an intelligent tool that analyzes your website's behavior and violation reports to automatically generate optimized Content Security Policies. It combines security best practices, compliance requirements, and your application's specific needs to create policies that protect your site without breaking functionality.
Why Use the CSP Builder?
The CSP Builder eliminates the complexity of manual CSP creation by automatically analyzing your application's needs, incorporating security best practices, and ensuring compliance with scoring agencies like BitSight and SecurityScorecard.
Prerequisites
Before using the CSP Builder, you need to:
- Connect your application to our CSP reporting endpoint
- Have violation reports from your current CSP implementation (recommended: 30+ days of data)
- Access to your web server configuration for policy deployment
Data Requirements
For optimal results, we recommend having at least 30 days of violation reports. This ensures the builder can accurately understand your application's resource requirements and generate a comprehensive policy.
Step-by-Step Guide to Using the CSP Builder
Step 1: Choose a Policy
The first step is to select an existing policy or create a custom one based on your needs.
What happens during this step:
- Automatic policy detection: The system scans your application to identify current CSP policies
- Custom policy support: You can start with a custom policy if you have one
- No policy needed: Let the builder generate one for you
Step 2: Select a Reporting Period
Choose the time range for analyzing violation reports to understand your application's resource requirements.
Key features of this step:
- Time range selection: Choose from 1 day to 90 days of data
- Report processing: The system analyzes millions of violation reports
- Resource identification: Automatically identifies required domains and sources
- Security analysis: Incorporates best practices and security rules
Report Analysis
The builder processes all violation reports to understand which resources your application legitimately needs, ensuring the generated policy won't break your site's functionality.
Step 3: Generate & Review Policy
The system automatically generates a comprehensive CSP policy based on your application's needs.
What the builder includes:
- All required sources based on violation analysis
- OWASP compliance checking built-in
- Security best practices included by default
- Scoring agencies compliance checking (BitSight, SecurityScorecard)
- Modern CSP features (nonces, hashes, strict-dynamic)
- Optimized for your specific application
Step 4: Review & Acknowledge
Use the interactive review wizard to examine each directive and approve or reject recommendations.
Review process features:
- Interactive review wizard: Step-by-step guidance through each directive
- Risk assessment: Each value is flagged with security implications
- Approval workflow: Review and approve each domain/source
- Confidence indicators: Visual cues for security risk levels
- Rollback protection: Easy to revert changes if needed
Review Best Practices
Always review the generated policy carefully. Start with report-only mode to test the policy before enforcing it. This prevents breaking your application while ensuring security.
Step 5: Copy Policy & Implement
Once satisfied with the policy, copy it to your clipboard and implement it in your web server configuration.
Additional CSP Tools
Explore our comprehensive suite of tools designed to help you manage and optimize your Content Security Policy.
Automatically scan your website to detect potential violations and security risks.
Evaluate and optimize your Content Security Policy for maximum protection.
Calculate the hash of your inline scripts and styles to use in your Content Security Policy.
Monitor and analyze violations in real-time with our dedicated reporting endpoint.
Automatically generate a tight policy for your website, based on your website's content.
Frequently Asked Questions
Everything you need to know about CSP Policy Builder
Ready to Simplify Your CSP Management?
Start building and optimizing your Content Security Policy today. Connect your reporting endpoint to enable automated improvements and keep your website secure.