What CSP Foundry does
Build, check and roll out a Content-Security-Policy: vendor-accurate presets, plain-English fixes, a console-error decoder and a report collector.
A Content-Security-Policy is one of the few defences that limits the damage of a cross-site-scripting bug, and one of the easiest ways to break your own site. Most guides give you a policy to paste and hope. CSP Foundry gets you there in the order that works: start from what your stack actually needs, deploy as Report-Only, read what real visitors' browsers would have blocked, then tighten.
The presets carry the sources each vendor documents, with the documentation linked. The evaluator explains every weakness in plain English and checks allowlisted hosts against Google's list of JSONP and AngularJS bypass hosts. The decoder turns a pasted console error into the exact origin or hash to add. The collector gives you a report URL, scrubs what arrives, and drafts the policy that would have allowed it.
The free tool covers the whole workflow for one site. Pro is $9 a month for more endpoints, ten times the daily volume, 30 days of history and the enforce check, which replays your collected reports against the policy you are about to ship.
Popular uses
Each opens CSP Foundry already set up for that job, with steps and answers for that case.
Free vs Pro
| Feature | Free $0 · no account | Pro $9/mo · 3 browsers |
|---|---|---|
| Presets for Next.js, Google Tag Manager, GA4, Stripe, Google Fonts, YouTube, reCAPTCHA, Turnstile and more, with sources taken from each vendor's documentation | Included | Included |
| Evaluate any pasted policy in plain English, checked against Google's JSONP and AngularJS bypass lists | Included | Included |
| Safe automatic fixes for quoting, duplicates, object-src, base-uri and form-action | Included | Included |
| Decode Chrome, Edge, Firefox and Safari console errors into the exact source or hash to add | Included | Included |
| Copy the policy as an HTTP header, firebase.json, nginx, Apache, Netlify, vercel.json, Next.js or Express | Included | Included |
| One report collector endpoint: up to 300 reports a day, kept 7 days, turned into a draft policy | Included | Included |
| 5 report endpoints | — | Pro |
| Up to 1,700 reports a day (about 50,000 a month) | — | Pro |
| Reports kept 30 days | — | Pro |
| Enforce check: replay every collected report against your policy and see what would still be blocked | — | Pro |
Pro is $9/mo, billed monthly. Checkout and the licence key are handled by Dodo Payments (merchant of record). By buying you agree to the Terms and Privacy Policy.
Questions
Is CSP Foundry free?
Yes, with no account and no install. The free plan includes: Presets for Next.js, Google Tag Manager, GA4, Stripe, Google Fonts, YouTube, reCAPTCHA, Turnstile and more, with sources taken from each vendor's documentation; Evaluate any pasted policy in plain English, checked against Google's JSONP and AngularJS bypass lists; Safe automatic fixes for quoting, duplicates, object-src, base-uri and form-action; Decode Chrome, Edge, Firefox and Safari console errors into the exact source or hash to add; and 2 more. Pro ($9/mo, billed monthly, cancel anytime) adds: 5 report endpoints; Up to 1,700 reports a day (about 50,000 a month); Reports kept 30 days; Enforce check: replay every collected report against your policy and see what would still be blocked.
Does CSP Foundry upload my data?
Only if you create a report endpoint. Building, evaluating and decoding run in your browser. An endpoint stores its name and, per distinct violation per day, a count, the directive, the blocked origin and one sample page path and script name with query strings removed. Browser-extension reports are dropped and no IP address is stored. Counts are deleted after 7 days (Pro 30); deleting the endpoint removes everything now. See the Privacy Policy for retention and deletion.
Do I need to install anything?
No. Open the page and start working. It works on desktop and mobile browsers.
How does the Pro licence work?
Pro is a monthly subscription handled by Dodo Payments (our merchant of record). You receive a licence key by email and paste it under "Have a key?" inside the tool. One key works on up to 3 browsers.
Is it safe to deploy a generated policy straight away?
No policy is safe to enforce without testing. Deploy it as Content-Security-Policy-Report-Only first: it changes nothing for visitors and reports what would have been blocked. Enforce only after the reports are clean.
Do you store my policy or my console errors?
No. Building, evaluating and decoding happen in your browser. Only the optional report endpoint stores anything, and only scrubbed counters.
