Generate Content Security Policy headers to protect your website. Review the result before reusing it in another workflow.
Fallback for other directives
'self'Valid sources for JavaScript
Valid sources for stylesheets
Valid sources for images
Valid sources for fonts
Valid sources for fetch, WebSocket, etc.
Valid sources for audio and video
Valid sources for plugins
Valid sources for frames
Valid sources for web workers
Valid sources for workers
Valid parents that can embed this page
Valid targets for form submissions
Valid base URLs for the document
Upgrade HTTP to HTTPS
Block HTTP content on HTTPS pages
Content-Security-Policy: default-src 'self'
Avoid using 'unsafe-inline' and 'unsafe-eval' when possible
Use 'object-src none' to prevent Flash/plugin attacks
Set frame-ancestors to prevent clickjacking
Enable upgrade-insecure-requests on HTTPS sites