Content-Security-Policy

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

For more information, see also this article on Content Security Policy (CSP).

Header type Response header
Forbidden header name no

Syntax

Content-Security-Policy: <policy-directive>; <policy-directive>

Directives

Fetch directives

Fetch directives control locations from which certain resource types may be loaded.

List of Content Security Policy Fetch directives

child-src
Defines the valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

Instead of child-src, authors who wish to regulate nested browsing contexts and workers should use the frame-src and worker-src directives, respectively.

connect-src
Restricts the URLs which can be loaded using script interfaces
default-src
Serves as a fallback for the other fetch directives.
font-src
Specifies valid sources for fonts loaded using @font-face.
frame-src
Specifies valid sources for nested browsing contexts loading using elements such as <frame> and <iframe>.
img-src
Specifies valid sources of images and favicons.
manifest-src
Specifies valid sources of application manifest files.
media-src
Specifies valid sources for loading media using the <audio> , <video> and <track> elements.
object-src
Specifies valid sources for the <object>, <embed>, and <applet> elements.
Elements controlled by object-src are perhaps coincidentally considered legacy HTML elements and are not recieving new standardized features (such as the security attributes sandbox or allow for <iframe>). Therefore it is recommended to restrict this fetch-directive (e.g. explicitly set object-src 'none' if possible).
prefetch-src
Specifies valid sources to be prefetched or prerendered.
script-src
Specifies valid sources for JavaScript.
script-src-elem
Specifies valid sources for JavaScript <script> elements.
script-src-attr
Specifies valid sources for JavaScript inline event handlers.
style-src
Specifies valid sources for stylesheets.
style-src-elem
Specifies valid sources for stylesheets <style> elements and <link> elements with rel="stylesheet".
style-src-attr
Specifies valid sources for inline styles applied to individual DOM elements.
worker-src
Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Document directives

Document directives govern the properties of a document or worker environment to which a policy applies.

List of Content Security Policy Document directives

base-uri
Restricts the URLs which can be used in a document's <base> element.
plugin-types
Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.
sandbox
Enables a sandbox for the requested resource similar to the <iframe> sandbox attribute.

Navigation directives govern to which location a user can navigate to or submit a form to, for example.

List of Content Security Policy Navigation directives

form-action
Restricts the URLs which can be used as the target of a form submissions from a given context.
frame-ancestors
Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.
navigate-to
Restricts the URLs to which a document can initiate navigation by any means, including <form> (if form-action is not specified), <a>, window.location, window.open, etc.

Reporting directives

Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only header.

List of Content Security Policy Reporting directives

report-uri
Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Though the report-to directive is intended to replace the deprecated report-uri directive, report-to is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:

Content-Security-Policy: ...; report-uri https://endpoint.example.com; report-to groupname

In browsers that support report-to, the report-uri directive will be ignored.

report-to
Fires a SecurityPolicyViolationEvent.

Other directives

block-all-mixed-content
Prevents loading any assets using HTTP when the page is loaded using HTTPS.
referrer
Used to specify information in the referer (sic) header for links away from a page. Use the Referrer-Policy header instead.
require-sri-for
Requires the use of SRI for scripts or styles on the page.
trusted-types
Used to specify a whitelist of Trusted Types policies (Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings).
upgrade-insecure-requests
Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

CSP in workers

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which requested the worker script itself.

The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.

Multiple content security policies

CSP allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a <meta> element.

You can use the Content-Security-Policy header more than once like in the example below. Pay special attention to the connect-src directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none' is enforced.

Content-Security-Policy: default-src 'self' http://example.com;
                         connect-src 'none';
Content-Security-Policy: connect-src http://example.com/;
                         script-src http://example.com/

Examples

Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:

// header
Content-Security-Policy: default-src https:

// meta tag
<meta http-equiv="Content-Security-Policy" content="default-src https:">

Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins:

Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'

Example: Do not implement the above policy yet; instead just report violations that would have occurred:

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

See Mozilla Web Security Guidelines for more examples.

Specifications

Specification Status Comment
Content Security Policy Level 3 Working Draft Adds manifest-src, navigate-to, report-to, strict-dynamic, worker-src. Undeprecates frame-src. Deprecates report-uri in favor if report-to.
Mixed Content Candidate Recommendation Adds block-all-mixed-content.
Subresource Integrity Recommendation Adds require-sri-for.
Upgrade Insecure Requests Candidate Recommendation Adds upgrade-insecure-requests.
Content Security Policy Level 2 Recommendation Adds base-uri, child-src, form-action, frame-ancestors, plugin-types, referrer, and report-uri. Deprecates frame-src.
Content Security Policy 1.0 Obsolete Defines connect-src, default-src, font-src, frame-src, img-src, media-src, object-src, report-uri, sandbox, script-src, and style-src.

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Content-Security-PolicyChrome Full support 25
Full support 25
Full support 14
Alternate Name
Alternate Name Uses the non-standard name: X-Webkit-CSP
Edge Full support 14Firefox Full support 23
Full support 23
Full support 4
Alternate Name
Alternate Name Uses the non-standard name: X-Content-Security-Policy
IE Full support 10
Notes Alternate Name
Full support 10
Notes Alternate Name
Notes Only supporting 'sandbox' directive.
Alternate Name Uses the non-standard name: X-Content-Security-Policy
Opera Full support 15Safari Full support 7
Full support 7
Full support 6
Alternate Name
Alternate Name Uses the non-standard name: X-Webkit-CSP
WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android Full support YesSafari iOS Full support 7.1
Full support 7.1
Full support 5.1
Notes
Notes X-Webkit-CSP
Samsung Internet Android Full support Yes
base-uriChrome Full support 40Edge No support NoFirefox Full support 35IE No support NoOpera Full support 27Safari Full support 10WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 35Opera Android ? Safari iOS Full support 9.3Samsung Internet Android Full support Yes
block-all-mixed-contentChrome Full support YesEdge ? Firefox Full support 48IE No support NoOpera Full support YesSafari ? WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 48Opera Android ? Safari iOS ? Samsung Internet Android Full support Yes
child-srcChrome Full support 40Edge Full support 15Firefox Full support 45IE No support NoOpera Full support 27Safari Full support 10WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 45Opera Android ? Safari iOS Full support 9.3Samsung Internet Android Full support Yes
connect-srcChrome Full support 25Edge Full support 14Firefox Full support 23
Notes
Full support 23
Notes
Notes Prior to Firefox 50, ping attributes of <a> elements weren't covered by connect-src.
IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
default-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
font-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
form-actionChrome Full support 40Edge Full support 15Firefox Full support 36IE No support NoOpera Full support 27Safari Full support 10WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 36Opera Android ? Safari iOS Full support 9.3Samsung Internet Android Full support Yes
frame-ancestorsChrome Full support 40Edge Full support 15Firefox Full support 33
Notes
Full support 33
Notes
Notes Before Firefox 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
IE No support NoOpera Full support 26Safari Full support 10WebView Android ? Chrome Android Full support YesFirefox Android Full support 33
Notes
Full support 33
Notes
Notes Before Firefox for Android 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
Opera Android ? Safari iOS Full support 9.3Samsung Internet Android Full support Yes
frame-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
img-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
manifest-srcChrome Full support YesEdge No support NoFirefox Full support 41IE No support NoOpera Full support YesSafari No support NoWebView Android Full support YesChrome Android Full support YesFirefox Android Full support 41Opera Android ? Safari iOS No support NoSamsung Internet Android Full support Yes
media-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
<meta> element supportChrome Full support YesEdge Full support YesFirefox Full support 45IE No support NoOpera Full support YesSafari Full support YesWebView Android Full support YesChrome Android Full support YesFirefox Android Full support 45Opera Android Full support YesSafari iOS Full support YesSamsung Internet Android Full support Yes
navigate-to
Experimental
Chrome No support NoEdge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android No support NoFirefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
object-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
plugin-typesChrome Full support 40Edge Full support 15Firefox No support No
Notes
No support No
Notes
Notes See bug 1045899.
IE No support NoOpera Full support 27Safari Full support 10WebView Android Full support YesChrome Android Full support YesFirefox Android No support NoOpera Android ? Safari iOS Full support 9.3Samsung Internet Android Full support Yes
prefetch-src
Experimental
Chrome No support No
Notes
No support No
Notes
Notes See bug 801561.
Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1457204.
IE No support NoOpera No support NoSafari No support No
Notes
No support No
Notes
Notes See bug 185070.
WebView Android No support No
Notes
No support No
Notes
Notes See bug 801561.
Chrome Android No support No
Notes
No support No
Notes
Notes See bug 801561.
Firefox Android No support No
Notes
No support No
Notes
Notes See bug 1457204.
Opera Android No support NoSafari iOS No support No
Notes
No support No
Notes
Notes See bug 185070.
Samsung Internet Android No support No
referrer
DeprecatedNon-standard
Chrome No support 33 — 56Edge No support NoFirefox No support 37 — 62IE No support NoOpera No support ? — 43Safari No support NoWebView Android No support 4.4.3 — 56Chrome Android No support 33 — 56Firefox Android No support 37 — 62Opera Android No support ? — 43Safari iOS No support NoSamsung Internet Android Full support Yes
report-sample
Experimental
Chrome Full support 59Edge ? Firefox ? IE ? Opera Full support 46Safari ? WebView Android Full support 59Chrome Android Full support 59Firefox Android ? Opera Android Full support 43Safari iOS ? Samsung Internet Android Full support 7.0
report-toChrome Full support 70Edge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android Full support 70Chrome Android Full support 70Firefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
report-uri
Deprecated
Chrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
require-sri-for
Experimental
Chrome Full support 54Edge No support NoFirefox No support 49 — 68
Disabled
No support 49 — 68
Disabled
Disabled From version 49 until version 68 (exclusive): this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera Full support 41Safari No support NoWebView Android Full support 54Chrome Android Full support 54Firefox Android No support 49 — 68
Disabled
No support 49 — 68
Disabled
Disabled From version 49 until version 68 (exclusive): this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Opera Android Full support 41Safari iOS No support NoSamsung Internet Android Full support 6.0
sandboxChrome Full support 25Edge Full support 14Firefox Full support 50IE Full support 10Opera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 50Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
script-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
script-src-attr
Experimental
Chrome Full support 75Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1529337.
IE No support NoOpera Full support 62Safari No support NoWebView Android Full support 75Chrome Android Full support 75Firefox Android No support No
Notes
No support No
Notes
Notes See bug 1529337.
Opera Android ? Safari iOS No support NoSamsung Internet Android ?
script-src-elem
Experimental
Chrome Full support 75Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1529337.
IE No support NoOpera Full support 62Safari No support NoWebView Android Full support 75Chrome Android Full support 75Firefox Android No support No
Notes
No support No
Notes
Notes See bug 1529337.
Opera Android ? Safari iOS No support NoSamsung Internet Android ?
strict-dynamicChrome Full support 52Edge No support NoFirefox Full support 52IE No support NoOpera Full support 39Safari No support NoWebView Android Full support 52Chrome Android Full support 52Firefox Android No support NoOpera Android Full support 41Safari iOS No support NoSamsung Internet Android Full support 6.0
style-srcChrome Full support 25Edge Full support 14Firefox Full support 23IE No support NoOpera Full support 15Safari Full support 7WebView Android Full support YesChrome Android Full support YesFirefox Android Full support 23Opera Android ? Safari iOS Full support 7.1Samsung Internet Android Full support Yes
style-src-attr
Experimental
Chrome Full support 75Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1529338.
IE No support NoOpera Full support 62Safari No support NoWebView Android Full support 75Chrome Android Full support 75Firefox Android No support No
Notes
No support No
Notes
Notes See bug 1529338.
Opera Android ? Safari iOS No support NoSamsung Internet Android ?
style-src-elem
Experimental
Chrome Full support 75Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1529338.
IE No support NoOpera Full support 62Safari No support NoWebView Android Full support 75Chrome Android Full support 75Firefox Android No support No
Notes
No support No
Notes
Notes See bug 1529338.
Opera Android ? Safari iOS No support NoSamsung Internet Android ?
trusted-types
Experimental
Chrome ?
?
No support 73 — 76
Disabled
Disabled From version 73 until version 76 (exclusive): this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Edge No support NoFirefox No support NoIE No support NoOpera No support NoSafari No support NoWebView Android No support NoChrome Android ?
?
No support 73 — 76
Disabled
Disabled From version 73 until version 76 (exclusive): this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
Firefox Android No support NoOpera Android No support NoSafari iOS No support NoSamsung Internet Android No support No
upgrade-insecure-requestsChrome Full support 43Edge No support No
Notes
No support No
Notes
Notes Under consideration for future release.
Firefox Full support 42IE No support NoOpera Full support 30Safari Full support 10.1WebView Android Full support 43Chrome Android Full support 43Firefox Android Full support 42Opera Android Full support 30Safari iOS Full support 10.3Samsung Internet Android Full support 4.0
Worker supportChrome Full support YesEdge ? Firefox Full support 50IE No support NoOpera ? Safari No support NoWebView Android Full support YesChrome Android Full support YesFirefox Android Full support 50Opera Android ? Safari iOS No support NoSamsung Internet Android Full support Yes
worker-srcChrome Full support 59
Notes
Full support 59
Notes
Notes Chrome 59 and higher skips the deprecated child-src directive.
Edge No support NoFirefox Full support 58IE No support NoOpera Full support 48Safari No support NoWebView Android Full support 59
Notes
Full support 59
Notes
Notes Chrome 59 and higher skips the deprecated child-src directive.
Chrome Android Full support 59
Notes
Full support 59
Notes
Notes Chrome 59 and higher skips the deprecated child-src directive.
Firefox Android Full support 58Opera Android Full support 45Safari iOS No support NoSamsung Internet Android Full support 7.0

Legend

Full support  
Full support
No support  
No support
Compatibility unknown  
Compatibility unknown
Experimental. Expect behavior to change in the future.
Experimental. Expect behavior to change in the future.
Non-standard. Expect poor cross-browser support.
Non-standard. Expect poor cross-browser support.
Deprecated. Not for use in new websites.
Deprecated. Not for use in new websites.
See implementation notes.
See implementation notes.
User must explicitly enable this feature.
User must explicitly enable this feature.
Uses a non-standard name.
Uses a non-standard name.

See also