Import an existing policy
Content-Security-Policy
A <meta http-equiv> tag only works for CSP, and cannot carry frame-ancestors, report-uri or sandbox — use the HTTP header itself when any of those are set.
Risk & recommendations
HSTS
Referrer-Policy
Permissions-Policy
Other headers
All headers
Built entirely in this browser — nothing you configure here is sent anywhere. Every CSP source is trimmed to end at the first space, comma or semicolon before it can reach the generated policy, so a typed value can never smuggle in a second directive. Risk flags here are a strong, practical lead, not a formal security audit — test a real policy with the browser's own console before relying on it in production.
The Security Headers & CSP Builder needs JavaScript: every header and every risk check is worked out live in this browser. With JavaScript switched off there is nothing to do the work.