DarnlyCSP generator: a Content Security Policy built from your site
Paste your site. We find every place it loads things from and build a policy that allows exactly those and blocks everything else, ready to copy for your host.
Free from Darnly. Spot a bug in the app you're building? Darnly hands it to Claude Code, Codex or Cursor in one key.Add to Chrome
Your policy
Also in the policy, for every site
default-src 'self': anything not listed above can only come from your own site.object-src 'none': no old plugins like Flash.base-uri 'self': injected code can’t change where your relative links point.form-action 'self': forms can only send to your site (plus any form services found).frame-ancestors 'self': other sites can’t show yours in a frame (stops clickjacking).upgrade-insecure-requests: http:// files are loaded over https://. Added when you switch off Report-Only.
The policy your site sends now
Check your other security headers with the security headers checker.
More free tools
See all 89 tools- API key leak checkerDid I leak an API key? Check your site’s JavaScript for OpenAI, Stripe, Supabase and other secret keys.
- JWT decoderPaste a token and see when it expires, who it’s for and its role, in plain words. Nothing is uploaded.
- EXIF removerSee if your photos show where you live, then remove the location, date and camera info in one click.
How it works
- Paste the address of your live site.
- We read the page, its stylesheets and its own JavaScript, and list every place it loads scripts, styles, images, fonts, data and embeds from.
- Remove anything you don’t recognise, choose how to handle inline scripts, and copy the policy for your host. Ship it as Report-Only first, then switch it on.
Questions
What is a Content Security Policy?
A list, sent with your pages, of the places your site is allowed to load things from. If someone manages to inject a script into your page, the browser refuses to run it because it isn’t on the list. It’s the strongest protection against cross-site scripting (XSS).
Will a CSP break my site?
It can, if it misses something your site needs. That’s why the copied header starts as Content-Security-Policy-Report-Only: the browser lets everything through but writes a message in the console for anything the policy would block. Click around your site for a few days, add what’s missing, then switch to Content-Security-Policy.
What are inline scripts, and why do they matter?
Code written straight into the HTML, like a script tag with code inside it, or onclick="…" on a button. A strict policy blocks it, because injected code looks the same. You can allow your exact scripts by their fingerprint (hash), allow all inline code (easier but much weaker), or move the code into .js files.
Why is there a domain I don’t recognise?
It was found in your page or code. Dashed ones were seen as addresses inside your JavaScript, which can include links your code never calls. Hover a domain to see why it’s there, and click × to remove it.
Where do I put the header?
Pick your host: a _headers file for Cloudflare Pages and Netlify, vercel.json for Vercel, or next.config.js for Next.js. The tag works anywhere, but it can’t be Report-Only and can’t stop other sites from framing yours.
Does it work for Next.js?
Yes, but Next.js writes new inline scripts on every page, so fixed hashes won’t match. Copy the prompt for your AI agent: it sets up a nonce in middleware, which is the way the Next.js docs recommend.