--- title: "Free CSP Chrome Extension - Build & Test Policies" description: "Free Chrome extension turns your browser into a CSP workbench. Watch live violations, rewrite the policy, or auto-build a strict header. No deploys." url: "https://next.centralcsp.com/en/tools/extension/" lang: "en" --- Chrome extension # Build CSP right in your browser. Watch live CSP violations, rewrite the policy on the fly, or auto-build a strict header, against real production pages, with no deploys. [Add to Chrome](https://chromewebstore.google.com/detail/centralcsp/pjalkmmdpdgoemhpghbjkgnphehfejof) [Explore the platform](https://next.centralcsp.com/en/platform/monitoring/) 5.0 · 600+ users on the Chrome Web Store Rec Clear Off Observe Rewrite Build Filter reports, directive, source, document… Build mode Strict report-only base. Violations are processed and your policy is built while you navigate. listening · 1 page · 244 reports Reports last 30s · by directive 30s 1m 5m 103 60 30 0 \-30s now Time Directive Blocked source 18:46:17 style-src-attr inline 18:46:15 style-src-attr inline 18:46:15 connect-src https://www.googletagmanager.com 18:46:13 style-src-attr inline 18:46:11 style-src-attr inline 18:46:11 connect-src https://www.googletagmanager.com 18:46:09 style-src-attr inline 18:46:07 style-src-attr inline 18:46:07 connect-src https://www.googletagmanager.com 18:46:05 style-src-attr inline 18:46:03 connect-src https://www.googletagmanager.com frame-src report 18:44:39 Parsed effective directive frame-src blocked uri https://www.youtube.com document uri https://shop.acme.com/checkout disposition report type csp-violation Raw JSON { "body": { "blockedURL": "https://www.youtube.com", "disposition": "report", "documentURL": "https://shop.acme.com/checkout", "effectiveDirective": "frame-src", "sample": "", "statusCode": 200 }, "id": "37afb202-d570-4b63-9091-2381d4897594", "origin": "https://shop.acme.com", "type": "csp-violation" } Current policy build Pretty Raw default-src 'none' ; script-src 'report-sample' 'report-sha256' ; script-src-elem 'self' 'unsafe-inline' https://cdn.acme.com ; script-src-attr 'none' ; style-src 'none' ; style-src-elem 'self' 'unsafe-inline' ; img-src 'self' data: ; font-src 'self' ; connect-src 'self' https://www.googletagmanager.com ; frame-src https://www.youtube.com ; object-src 'none' ; base-uri 'none' ; form-action 'none' ; frame-ancestors 'none' ; ## One extension, three ways to work a policy. Pick the mode that matches where you are, from watching what breaks to shipping a locked-down header. ### Observe Stream every violation from the site's existing CSP into the popup and DevTools panel, mapped line by line to the policy that broke, without changing a thing. ### Rewrite Swap in your candidate policy on the fly. Choose Enforce or Report-Only, Replace or Append, reload, and watch violations stream in as parsed and raw JSON. ### Build Start from a strict report-only base, browse the site normally, and let the extension classify violations by directive and assemble a working policy from real page loads. ## See the extension in action. The loop ## A five-second feedback loop. Edit the policy, reload, and see exactly what breaks, against the real page and its real third-parties. No staging, no deploy. ### install One click from the Chrome Web Store. The extension stays inactive until you switch it on for a site. ### pick a mode Choose Observe, Rewrite, or Build depending on whether you're watching, testing, or authoring. ### iterate Edit the policy and reload. Each pass gives you five-second feedback against real third-parties. ### ship Refine the assembled policy, then ship it Report-Only first, then Enforce. ## Everything you need to get a policy right. A full CSP toolkit in the toolbar, from live rewriting to a copy-ready header. ### Rewrite live headers Replace or append the CSP on any response, in Enforce or Report-Only, without touching the server. ### Real-time violations Every violation streamed the instant it fires, with the parsed report and the raw JSON side by side. ### Auto-build policies Turn observed traffic into a strict policy, classified by directive and grounded in real page loads. ### Copy-ready headers Generate a clean, deploy-ready Content-Security-Policy header you can paste straight into your config. ### Fully local No accounts, no telemetry, no outbound calls. Everything runs and stays inside your browser. ### Works on production Test against the real page and its real third-parties. A CSP you can't test against the real page is a guess. Beyond the browser ## The extension builds the policy. The platform keeps it honest. Author in the browser, then monitor the same policy in production around the clock. ### From one-off testing to continuous protection The extension is where you author and debug. The CentralCSP platform then watches that policy in production, around the clock, across every visitor's browser. [Start free trial](https://app.next.centralcsp.com) Continuous client-side monitoring dashboard ### Continuous collection 24/7 CSP report collection from your real users' browsers, not a single local session. ### Script inventory Every script on every page, fingerprinted with SHA-256/384/512 hashes and checked for known CVEs. ### Alerts and PCI evidence Real-time Slack and webhook alerts on new origins and scripts, plus auditor-ready PCI DSS v4 evidence. FAQ ## Extension questions, answered The essentials on installing, privacy, and how the extension fits with the platform. ### Is the extension free? Yes. It's completely free, with no signup and no account required. Install it from the Chrome Web Store and start working a policy right away. ### Does the extension send my data anywhere? No. Everything runs inside your browser. There are no accounts, no telemetry, and no outbound calls, so your policies and violations never leave your machine. ### Which browsers are supported? It's built for Chrome and Chromium-based browsers such as Edge, Brave, and Arc, and installs in one click from the Chrome Web Store. ### How is the extension different from the CentralCSP platform? The extension is a local workbench for authoring and debugging a policy by hand. The platform continuously monitors your policy in production from real browser traffic, inventories every script, alerts your team, and exports PCI DSS v4 evidence. ### Do I need to deploy anything to test a policy? No, that's the point. You rewrite headers in the browser and test against the real production page and its real third-parties, with no staging environment and no server deploys. ## Start building your CSP in the browser. Add the extension in one click. It's free, local, and needs no signup. [Add to Chrome](https://chromewebstore.google.com/detail/centralcsp/pjalkmmdpdgoemhpghbjkgnphehfejof) [See the platform](https://next.centralcsp.com/en/platform/monitoring/) --- Available in: [en](https://next.centralcsp.com/en/tools/extension/), [fr](https://next.centralcsp.com/fr/tools/extension/)