The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS (en-US)).

For more information, see the introductory article on Content Security Policy (CSP).


Content-Security-Policy: <policy-directive>; <policy-directive>


Fetch directives (en-US)

Fetch directives control locations from which certain resource types may be loaded.

List of Content Security Policy Fetch directives

child-src (en-US)
Defines the valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

Instead of child-src, authors who wish to regulate nested browsing contexts and workers should use the frame-src (en-US) and worker-src (en-US) directives, respectively.

connect-src (en-US)
Restricts the URLs which can be loaded using script interfaces
Serves as a fallback for the other fetch directives (en-US).
font-src (en-US)
Specifies valid sources for fonts loaded using @font-face.
frame-src (en-US)
Specifies valid sources for nested browsing contexts loading using elements such as <frame> and <iframe>.
Specifies valid sources of images and favicons.
manifest-src (en-US)
Specifies valid sources of application manifest files.
media-src (en-US)
Specifies valid sources for loading media using the <audio> , <video> and <track> elements.
object-src (en-US)
Specifies valid sources for the <object>, <embed>, and <applet> elements.
Elements controlled by object-src are perhaps coincidentally considered legacy HTML elements and are not recieving new standardized features (such as the security attributes sandbox or allow for <iframe>). Therefore it is recommended to restrict this fetch-directive (e.g. explicitly set object-src 'none' if possible).
prefetch-src (en-US) Experimental
Specifies valid sources to be prefetched or prerendered.
Specifies valid sources for JavaScript.
script-src-elem (en-US) Experimental
Specifies valid sources for JavaScript <script> elements.
script-src-attr (en-US) Experimental
Specifies valid sources for JavaScript inline event handlers.
style-src (en-US)
Specifies valid sources for stylesheets.
style-src-elem (en-US) Experimental
Specifies valid sources for stylesheets <style> elements and <link> elements with rel="stylesheet".
style-src-attr (en-US) Experimental
Specifies valid sources for inline styles applied to individual DOM elements.
worker-src (en-US) Experimental
Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Document directives (en-US)

Document directives govern the properties of a document or worker environment to which a policy applies.

List of Content Security Policy Document directives

base-uri (en-US)
Restricts the URLs which can be used in a document's <base> element.
plugin-types (en-US)
Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.
sandbox (en-US)
Enables a sandbox for the requested resource similar to the <iframe> sandbox attribute.

Navigation directives govern to which location a user can navigate to or submit a form to, for example.

List of Content Security Policy Navigation directives

form-action (en-US)
Restricts the URLs which can be used as the target of a form submissions from a given context.
frame-ancestors (en-US)
Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.
Restricts the URLs to which a document can initiate navigation by any means, including <form> (if form-action (en-US) is not specified), <a>, window.location, (en-US), etc.

Reporting directives (en-US)

Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only (en-US) header.

List of Content Security Policy Reporting directives

report-uri (en-US) Deprecated
Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Though the report-to directive is intended to replace the deprecated report-uri directive, report-to is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:

Content-Security-Policy: ...; report-uri; report-to groupname

In browsers that support report-to, the report-uri directive will be ignored.

report-to Experimental
Fires a SecurityPolicyViolationEvent.

Other directives

block-all-mixed-content (en-US)
Prevents loading any assets using HTTP when the page is loaded using HTTPS.
referrer (en-US) Deprecated Non-Standard
Used to specify information in the referer (sic) header for links away from a page. Use the Referrer-Policy (en-US) header instead.
require-sri-for (en-US) Experimental
Requires the use of SRI (en-US) for scripts or styles on the page.
require-trusted-types-for (en-US) Experimental
Enforces Trusted Types at the DOM XSS injection sinks.
trusted-types (en-US) Experimental
Used to specify a whitelist of Trusted Types policies (Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings).
upgrade-insecure-requests (en-US)
Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

CSP in workers

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which requested the worker script itself.

The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.

Multiple content security policies

CSP allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only (en-US) header and a <meta> element.

You can use the Content-Security-Policy header more than once like in the example below. Pay special attention to the connect-src (en-US) directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none' is enforced.

Content-Security-Policy: default-src 'self';
                         connect-src 'none';
Content-Security-Policy: connect-src;


Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:

// header
Content-Security-Policy: default-src https:

// meta tag
<meta http-equiv="Content-Security-Policy" content="default-src https:">

Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins:

Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'

Example: Do not implement the above policy yet; instead just report violations that would have occurred:

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

See Mozilla Web Security Guidelines for more examples.


Specification Status Comment
Content Security Policy Level 3 Working Draft Adds manifest-src, navigate-to, report-to, strict-dynamic, worker-src. Undeprecates frame-src. Deprecates report-uri in favor if report-to.
Mixed Content Candidate Recommendation Adds block-all-mixed-content.
Subresource Integrity Recommendation Adds require-sri-for.
Upgrade Insecure Requests Candidate Recommendation Adds upgrade-insecure-requests.
Content Security Policy Level 2 Recommendation Adds base-uri, child-src, form-action, frame-ancestors, plugin-types, referrer, and report-uri. Deprecates frame-src.
Content Security Policy 1.0 Obsolete Defines connect-src, default-src, font-src, frame-src, img-src, media-src, object-src, report-uri, sandbox, script-src, and style-src.

Browser compatibility

BCD tables only load in the browser

See also