Tooloo

Tooloo · Security toolkit

CSP Tools

Build and analyze Content Security Policies for common risky directives.

Local processingNo input storage

Assemble a Content-Security-Policy

Start from a baseline, then adjust each directive. The policy string updates immediately.

Everything is computed in this browser and never sent to a server.

Generated policy

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests
Directives and sources
default-src
script-src
style-src
img-src
font-src
connect-src
frame-src
frame-ancestors
form-action
base-uri
object-src
Baseline

None of the common risks this tool checks were detected. That is not a complete security review, and the policy still needs testing against the real application.

CSP is one defense layer. unsafe-inline, unsafe-eval, *, and uncontrolled report endpoints can weaken it.

How to use

How does it work?

Select sources in the generator or paste a policy to flag risky directives.

Privacy

Can CSP completely prevent XSS?

No. Output encoding, validation, reliable frameworks, and other controls are still needed.

Limits and guidance

Security limits

Output is a configuration aid and does not prove a website is safe from XSS or other attacks.

← All security tools