A Content Security Policy tells browsers which scripts, styles and other resources your pages may load, so that an injected script cannot run. This generator starts from a strict policy and adds only what you name, or what your homepage loads if you ask it to read your site. The policy is built in your browser; only the address you ask us to read is sent to our server, and it is not stored.
Start from your site
We read your homepage the way a browser does, grade the policy it sends today, and add every script, style, image, font, media, frame and form source it uses to the generator, with hashes for its inline scripts. The address is not stored.