Granular control over Content Security Policy headers and HTML meta tags — not just an on/off switch.
CSP Manager lets you choose exactly how Content Security Policy is handled on any site: remove policies entirely, apply a developer-friendly preset, override specific directives, or inject your own custom policy. Instead of the blunt “disable everything” approach most CSP extensions take, you get directive-level precision — so you can unblock exactly what you’re debugging and leave the rest of the policy intact.
Built for developers, security testers, and QA engineers who need to see how a page behaves when CSP changes — without spelunking through DevTools on every reload.
Features
- One-toggle removal — strip CSP headers and meta tags instantly.
- Three built-in presets — Development, Testing, and Locked Down.
- Directive-level editing — modify individual directives instead of nuking the whole policy.
- Full custom policy injection — supply your own CSP and test it live.
- Per-site regex rules — apply different handling to different hosts automatically.
- Lightweight content script at document start — no DevTools required.
How It Works
The extension uses the declarativeNetRequest API to modify HTTP response headers before they reach the browser. A content script injected at document_start removes or blocks HTML meta CSP tags before the page renders, catching policies that headers alone wouldn’t cover.
Changes apply instantly, without reloading the browser.
Who Should Use It
- Web developers debugging inline scripts,
eval, or external resources blocked by CSP. - Security testers validating policy behavior and confirming directives do what they claim.
- QA engineers verifying site functionality in restricted environments.
Why Directive-Level Control Beats a Simple Toggle
Most CSP extensions give you one choice: policy on, or policy off. That’s fine for a quick sanity check, but it tells you very little. If you disable CSP entirely and the page works, you still don’t know which directive was blocking you — and you’ve just turned off every protection on the page while you browse.
Directive-level editing changes the workflow. Relax script-src while leaving frame-ancestors intact. Test a proposed policy before shipping it. Apply a Development preset on localhost and a Locked Down preset elsewhere via per-site regex rules. You get an answer to the actual question — what specifically is blocked, and what happens when it isn’t — instead of a binary yes or no.
Responsible Use
Content Security Policy is a real security control. It defends against cross-site scripting and data injection on sites you visit. This extension is a development and testing tool: disable CSP only on sites and environments you’re actively working on, use per-site rules rather than blanket removal, and keep protections on for everyday browsing. The Locked Down preset and per-site scoping exist precisely so you don’t have to leave yourself exposed while you work.
Frequently Asked Questions
What does CSP Manager do? It gives you granular control over Content Security Policy headers and meta tags — letting you remove them, apply a preset, override individual directives, or inject a fully custom policy on a per-site basis.
How is this different from other CSP disablers? Most extensions offer only a global on/off toggle. CSP Manager adds directive-level editing, three presets, custom policy injection, and per-site regex rules, so you can change exactly what you need instead of disabling everything.
Does it handle CSP in meta tags, or only headers? Both. HTTP response headers are modified via the declarativeNetRequest API, and a content script running at document_start removes or blocks HTML meta CSP tags before the page renders.
Do I need to reload the browser for changes to apply? No. Changes apply instantly without a browser reload.
What are the built-in presets? There are three: Development, Testing, and Locked Down — so you can switch between a permissive debugging setup and a strict policy without hand-editing directives each time.
Can I apply different rules to different sites? Yes. Per-site regex rules let you target specific hosts, so you can keep a relaxed policy on your development environment and a strict one everywhere else.
Do I need DevTools open to use it? No. The lightweight content script runs at document start, so policies are handled before the page renders — no DevTools session required.
Is it safe to disable CSP? CSP is a genuine security protection against XSS and injection attacks, so it shouldn’t be disabled during normal browsing. Use per-site rules to scope changes to the environments you’re actively testing, and keep protections on elsewhere.
Install CSP Manager and debug Content Security Policy the precise way — directive by directive, site by site.