💻 CSP Examples

Copy-paste ready Content Security Policy examples for every use case.

Stop guessing which domains to whitelist. We’ve done the work for you.

🔥 Most Used

CSP Examples for Third-Party Services — Google Analytics, Stripe, Hotjar, and more
Nonce-Based CSP Setup — The strongest XSS protection

📚 All Examples

CSP for Common Third-Party Services — Google Analytics, Fonts, Stripe, Intercom, Hotjar
Strict CSP with Nonces — PHP, Node.js, Python, Next.js examples
CSP for WordPress, Drupal, Joomla — CMS-specific configurations
CSP for React, Vue, Angular — SPA framework examples
CSP Report-Only Mode — Test before enforcing

🧪 Test Your CSP

Verify your configuration with headertest.com — free and instant.

Nonce-Based CSP: The Strongest XSS Protection You Can Get

If you’re serious about XSS prevention, nonce-based CSP is the way to go. It’s stronger than hash-based CSP, more maintainable than domain whitelisting, and once you understand the pattern, it’s not that complicated. What Is a Nonce? A nonce (Number Used Once) is a random string generated by your server for each HTTP request. You include it in your CSP script-src directive AND in every <script> tag on the page. Scripts without the correct nonce are blocked. ...

💻 CSP Examples#

🔥 Most Used#

📚 All Examples#

🧪 Test Your CSP#

💻 CSP Examples

🔥 Most Used

📚 All Examples

🧪 Test Your CSP