PHPackages                             jdz/cspmaker - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. jdz/cspmaker

ActiveLibrary[Security](/categories/security)

jdz/cspmaker
============

Build Content Security Policy (CSP) header strings from a fluent builder, a config array/file, or reusable third-party integration recipes

1.0.0(1mo ago)021MITPHPPHP >=8.2

Since Jul 9Pushed 1mo agoCompare

[ Source](https://github.com/joffreydemetz/cspMaker)[ Packagist](https://packagist.org/packages/jdz/cspmaker)[ Docs](https://jdz.joffreydemetz.com/cspmaker)[ RSS](/packages/jdz-cspmaker/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (1)Dependencies (2)Versions (2)Used By (1)

jdz/cspmaker
============

[](#jdzcspmaker)

Build **Content Security Policy** header strings without forgetting a directive.

The whole point: a third party like Matomo needs to be whitelisted in `script-src`**and** `img-src` **and** `connect-src`. Hand-list those and you will eventually forget one — and the browser silently blocks the request. cspMaker gives you one source of truth for the CSP directive vocabulary, plus reusable **integration recipes** that know every directive a service touches.

```
composer require jdz/cspmaker

```

Requires PHP 8.2+. Zero runtime dependencies (`symfony/yaml` is only needed for `CspBuilder::fromYaml()`).

Three ways in, one header out
-----------------------------

[](#three-ways-in-one-header-out)

### 1. Fluent builder

[](#1-fluent-builder)

```
use JDZ\CspMaker\CspBuilder;

$csp = CspBuilder::create()
    ->defaultSrc("'none'")
    ->scriptSrc('self', 'unsafe-inline')
    ->styleSrc('self', 'unsafe-inline')
    ->fontSrc('self', 'data')
    ->imgSrc('self', 'data')
    ->connectSrc('self')
    ->matomo('piwik.example.com')   // script + img + connect + frame, atomically
    ->build();

// default-src 'none'; script-src 'self' 'unsafe-inline' piwik.example.com; …
```

`->allowHost($host, ['script','img','connect'])` is the low-level primitive when there's no recipe: one host across many directives in a single call.

### 2. Config array or YAML file

[](#2-config-array-or-yaml-file)

```
$csp = CspBuilder::fromYaml('config/csp.yml')->build();
```

```
# config/csp.yml
policy:
  default-src: [self]
  script-src:  [self, unsafe-inline]
  img-src:     [self, data]
  connect-src: [self]
integrations:
  - matomo: piwik.example.com
  - googleFonts
```

`fromArray()` accepts the same structured shape, or a flat `directive => sources` map.

### 3. Named integration recipes

[](#3-named-integration-recipes)

`matomo($host)`, `googleFonts()`, `googleAnalytics()`, `googleTagManager()`, `youtube()`, `recaptcha()`, `stripe()` — each expands to exactly the directives that service requires. Ship your own by implementing `Integration` and registering it:

```
CspBuilder::create()->registerIntegration(new MyWidget())->with('my-widget');
```

Niceties
--------

[](#niceties)

- **Short aliases** — `script` ↔ `script-src`, `img` ↔ `img-src`, …
- **Token normalization** — `self` → `'self'`, `data` → `data:`, nonces/hashes quoted.
- **Validation** — adding a source to a misspelled directive throws instead of silently vanishing.
- **`'none'` collapse**, dedup, and a stable canonical render order.
- **`lint()`** — advisories (missing `default-src`, `'unsafe-inline'`, unconstrained `object-src`).

Used by
-------

[](#used-by)

[`jdz/htaccessmaker`](https://jdz.joffreydemetz.com/htaccessmaker)'s `CspContainer`delegates to cspMaker to emit the `Content-Security-Policy` header.

###  Health Score

38

—

LowBetter than 83% of packages

Maintenance90

Actively maintained with recent releases

Popularity2

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity46

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

48d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/5e83e3701566e43438525ed14578487e732b849d152b5071aa1613a0dad96913?d=identicon)[jdz](/maintainers/jdz)

---

Top Contributors

[![joffreydemetz](https://avatars.githubusercontent.com/u/15113527?v=4)](https://github.com/joffreydemetz "joffreydemetz (1 commits)")

---

Tags

securitycspcontent-security-policymakerJDZ

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/jdz-cspmaker/health.svg)

```
[![Health](https://phpackages.com/badges/jdz-cspmaker/health.svg)](https://phpackages.com/packages/jdz-cspmaker)
```

###  Alternatives

[spatie/laravel-csp

Add CSP headers to the responses of a Laravel app

86911.6M28](/packages/spatie-laravel-csp)[aidantwoods/secureheaders

A PHP class aiming to make the use of browser security features more accessible.

433747.4k2](/packages/aidantwoods-secureheaders)[born05/craft-csp

Content Security Policy (or CSP) generator using nonces.

1110.5k](/packages/born05-craft-csp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)