CSP Builder & Analyzer
Build a Content Security Policy, analyze an existing policy for common gaps, review framing directives, and copy deployment-ready output.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self';
Use CSP to control both sides of an iframe
Content Security Policy is broader than iframe security, but two directives matter especially when you work with frames. frame-src limits which frame destinations your page may load. frame-ancestors limits which parent pages are allowed to embed your page.
These directives are easy to confuse because their names are similar. Think of frame-src as outbound from the current page and frame-ancestors as inbound to the current page.
Why frame-ancestors belongs in an HTTP header
The browser evaluates the framed page's own response policy before rendering it. frame-ancestors is not supported in a CSP meta element, so configure it at the server, framework, CDN or reverse-proxy layer.
Build a minimum policy, then test
A CSP copied from another site can break scripts, styles, images, API calls or forms. Start from the actual resources your application uses, prefer narrow sources, test in report-only mode, and then enforce the policy after reviewing violations.
Technical references
Common questions
What is the difference between frame-ancestors and frame-src?
frame-ancestors controls which parent origins may embed the current page. frame-src controls which frame URLs the current page is allowed to load. They solve opposite sides of the framing relationship.
Does frame-ancestors fall back to default-src?
No. frame-ancestors has no default-src fallback, so you need to set it explicitly when you want to control who may frame a page.
Can frame-ancestors be set in a meta tag?
No. frame-ancestors must be delivered in the Content-Security-Policy HTTP response header.
Should I enforce a new CSP immediately?
Usually not. Test on staging and consider Content-Security-Policy-Report-Only first so you can identify legitimate resources that the policy would block before enforcing it.