Developer tools
CSP Header Builder and Validator
Review a CSP before placing it in deployment headers.
Processed locally. Your input and output are never uploaded.
Tool overview
CSP Header Builder and Validator tool overview
Build and inspect a Content-Security-Policy from pasted directives. PasteTidy keeps the source and generated result separate so the transformation can be reviewed before copying or downloading.
CSP Header Builder and Validator workflows
- Prepare csp header builder and validator output for a repeatable workflow
- Review local results before publishing or importing
- Keep sensitive pasted content in the current browser tab
Use CSP Header Builder and Validator locally
- Paste the source text or load the example.
- Choose the documented options.
- Review the result and any warnings before copying it.
CSP Header Builder and Validator controls
- Options are explicit and affect only the local result.
- The output remains separate from the source for review.
- No input or output is placed in URLs or analytics.
CSP Header Builder and Validator example
Before
default-src self script-src self cdn.example.com object-src none
After
default-src 'self'; script-src 'self' cdn.example.com; object-src 'none' Warnings: none
CSP Header Builder and Validator limits and excluded claims
- It audits syntax and obvious risks, not browser-specific policy behavior or complete application security.
- Malformed or ambiguous input may require manual review.
- Large inputs remain subject to browser memory and shared worker limits.
Browse all developer tools tools โ
Questions
CSP Header Builder and Validator FAQ
Does CSP Header Builder and Validator upload my input?
No. It runs locally in your browser without an upload endpoint.
Is the result authoritative?
It audits syntax and obvious risks, not browser-specific policy behavior or complete application security.
Can I review the source after processing?
Yes. The input remains separate from the generated result until you reset or replace it.