--- title: "CSP generator: build a strict policy from real traffic" description: "Build a strict Content Security Policy from real browser reports, not a one-page crawl. Prune extension noise, then move from report-only to enforced safely." url: "https://next.centralcsp.com/en/platform/csp-builder/" lang: "en" --- CSP builder # The strictest CSP your site can run, built from real traffic. A strict Content Security Policy is your best defense against cross-site scripting, and the hardest header to write by hand. CentralCSP builds yours from what real browsers report, not from a crawler's snapshot of your homepage. [Start free trial](https://app.next.centralcsp.com) [Scan your current policy](https://next.centralcsp.com/en/tools/csp-scanner/) - From real traffic Not a crawler snapshot - One response header No agent, no page script - Report-only first Enforce when it's clean - Directive by directive Every source justified How it works ## From real reports to a policy you can enforce. No crawl, no guesswork, no allowlist typed from memory. Your visitors' browsers do the fieldwork, and you approve the result. 1. MyEndpoint.report.centralcsp.com 01 - Collect ### Real browsers report every source Ship the report-only policy we generate for you. It blocks nothing, and from that moment every visitor's browser reports each script, style and connection your pages actually load. 2. 02 - Build ### We draft the policy, directive by directive CentralCSP turns those reports into a Content Security Policy: script-src, connect-src, style-src and the rest, each filled with the exact sources your real traffic justifies and nothing it doesn't. 3. 03 - Deploy ### Deploy the policy you built When the report-only run is clean, copy the finished header and deploy it from your CDN, proxy or framework. Serve it as enforcing and the browser blocks everything the policy doesn't allow. ### You approve the policy before it ships. Every source the builder proposes carries its evidence: how many browsers loaded it, on which pages, and when it was last seen. A real dependency is obvious, and the junk that ad blockers and password managers inject gets flagged as extension noise so it never lands in your allowlist. Keep what's real, drop the rest, one directive at a time. - Each source ranked by report volume - Browser-extension noise flagged for you - Keep or drop, directive by directive ### It ships strict, not just working. A crawler emits a loose allowlist that happens to load your page. A report-driven policy locks script-src to the exact hosts your traffic uses, closes connect-src to the origins you actually talk to, and sets object-src and base-uri to none. Where an inline script would force unsafe-inline, the builder flags it instead of quietly weakening the policy, so an attacker gets no XSS foothold from a loophole you never noticed. - script-src limited to the hosts you actually load - connect-src, object-src and base-uri locked down - Inline scripts flagged, never silently allowed Approaches ## Three ways to get a Content Security Policy. A CSP is only as good as its coverage. Here is the honest comparison between writing one by hand, scanning a page for one, and building it from the traffic you already have. Comparison of ways to produce a Content Security Policy | | CentralCSP | Crawler / scanner | By hand | | --- | --- | --- | --- | | Covers pages behind a login | Yes: Every visited page | No: Homepage only | Partly: If you remember it | | Sees conditional third parties | Yes: Real sessions catch them | No: Missed if not triggered | Partly: Only what you know | | Filters browser-extension noise | Yes: Flagged by volume | No: Not distinguished | No: You guess | | Stays current as the site changes | Yes: New reports show drift | No: A one-time snapshot | No: Manual rewrite | | Reaches enforcement safely | Yes: Report-only, then enforce | Partly: Starter policy only | No: Days of testing | Alerting ## A new source shows up? You hear about it. The same reports that build your policy can page you. When a script loads from an origin your policy never allowed, CentralCSP posts it to Slack, Teams, Google Chat, Telegram or email before the next visitor loads the page. - New-origin and hash-change rules - Violation spikes after a deploy - Routed to the channel that owns the page [See alerting](https://next.centralcsp.com/en/platform/alerting/) Monitoring ## CSP is one report. Browsers send eleven more. Your policy only reports what it blocks. Real browsers also report network errors, crashed tabs, deprecations and integrity failures, and CentralCSP collects all twelve types on the same endpoint, deduped and classified. - All 12 browser report types, one endpoint - Deduped, grouped and searchable - Server-side failures the browser sees first [See monitoring](https://next.centralcsp.com/en/platform/monitoring/) Check your headers ## What does your site send today? Two minutes, no account: scan your live headers and see whether you have a Content Security Policy at all, how strict it is, and which origins can run code on your pages right now. Scan my site Free, no account needed. Results land on a shareable page. FAQ ## Frequently asked questions Building a policy, filtering noise and rolling it out, answered. ### Can you really build a Content Security Policy from real traffic? Yes, and it is the point. You deploy a report-only policy once, and every browser that visits reports the scripts, styles and connections your pages load. CentralCSP aggregates those reports into a policy that covers your whole site, including the pages and third parties a one-page crawler never reaches. ### Will a generated CSP break my site when I turn it on? Not the way we roll it out. The policy runs in report-only first, which reports violations but blocks nothing, so you see exactly what enforcing would break before it breaks. You flip to enforcing only once the report-only run is clean, and you can flip back at any time. ### What is report-only mode? A Content Security Policy can be sent in two forms. Content-Security-Policy enforces: the browser blocks anything the policy disallows. Content-Security-Policy-Report-Only only reports the violations and blocks nothing. Report-only is how you test a policy against real traffic safely, and it is where every policy here starts. ### How do you filter out browser-extension noise? Ad blockers, password managers and other extensions inject code into every page, and that code trips your policy. It is the main reason CSP reports feel like noise. CentralCSP ranks every source by how many browsers and pages reported it and flags the injected-by-extension pattern, so a source that showed up once inside one user's browser doesn't get mistaken for a real dependency. ### How is this different from a free CSP generator that scans my URL? A scanner loads one page in a headless browser and writes a policy for what it happened to see. It misses anything behind a login, a click or an A/B test, and the third-party widget that only loads for some visitors. A policy built from real traffic covers all of it, because the reports come from real users on every page they actually opened. ### Do I need an existing CSP to start? No. You start from a strict report-only base (default-src 'none'), collect for as long as your traffic needs, and let the builder fill the directives from what real browsers report. If you already run a CSP, point its report-to at the same endpoint and CentralCSP builds on what you have. ### Does the policy stay current as my site changes? Reports keep arriving, so the builder keeps showing drift: a new script, a new origin, a source that stopped appearing. You tighten the policy when something legitimate is added and get alerted when something you never approved shows up, instead of rewriting the header by hand every release. ## Start collecting today. Enforce when you're ready. Ship one report-only header this afternoon and watch the policy draft itself from your real traffic. 14-day free trial, no agent, no page script. [Start free trial](https://app.next.centralcsp.com) [Evaluate a policy for free](https://next.centralcsp.com/en/tools/csp-evaluator/) --- Available in: [en](https://next.centralcsp.com/en/platform/csp-builder/), [fr](https://next.centralcsp.com/fr/platform/csp-builder/)