Manage your allowed sources

Import an existing policy, then refine each directive and the origins it can trust.

Import current policy

Paste a policy, or paste the header output from the command below.

Get headers from a live URL

This app never fetches URLs itself. Run the command below in your own terminal, then paste the output into the box above — it works for internal hosts and anything needing your VPN, cookies, or client certificates.

Show all response headers (use if the filtered command prints nothing)

3 directives

Directive

Fallback policy for all resource types

'self'

Directive

Controls JavaScript sources

'self' https://cdn.example.com

Directive

Controls image sources

'self' data: https://images.example.com

Generated policy

Ready to add as a response header

One line

default-src 'self';
script-src 'self' https://cdn.example.com;
img-src 'self' data: https://images.example.com

Suggestions are editable. Add exact origins when possible instead of broad wildcards.

Policy review

3 notes

Presets

Saved locally in this browser

No presets yet. Save the current policy to reuse it later.