CSP directives
The fallback column is the one to read. Directives that do not inherit from
default-src are the ones missing from most real policies.
Fetch directives
| Directive | Purpose | Falls back to |
|---|---|---|
default-src |
The fallback for most fetch directives. Setting it does not cover everything. | nothing |
script-src |
Where executable script may come from. The directive that decides whether your CSP is worth anything. | default-src |
style-src |
Where stylesheets may come from. | default-src |
img-src |
Where images may be loaded from. | default-src |
connect-src |
Where fetch, XHR, WebSocket and EventSource may connect. | default-src |
font-src |
Where fonts may be loaded from. | default-src |
object-src |
Plugin content. Should be 'none' on essentially every site. | default-src |
frame-src |
What your page may put in a frame. | child-src, then default-src |
worker-src |
Where Worker, SharedWorker and ServiceWorker scripts may come from. | child-src, then script-src, then default-src |
manifest-src |
Where the web app manifest may be loaded from. | default-src |
media-src |
Where audio and video may be loaded from. | default-src |
child-src |
Legacy directive covering frames and workers. Superseded by frame-src and worker-src. | default-src |
Document and navigation directives
| Directive | Purpose | Falls back to |
|---|---|---|
frame-ancestors |
Who may embed your page in a frame. The modern replacement for X-Frame-Options. | nothing |
base-uri |
Restricts the <base> tag. Missing from most policies, and its absence undoes nonce-based CSP. | nothing |
form-action |
Where forms may submit. Does not fall back to default-src. | nothing |
sandbox |
Applies iframe sandbox restrictions to the document itself. | nothing |
Source keywords
| Directive | Purpose | Falls back to |
|---|---|---|
'strict-dynamic' |
A script-src keyword that discards the host allowlist and propagates trust from nonces instead. | nothing |
'unsafe-inline' |
Permits inline script and style. In script-src it negates the policy — unless a nonce or hash is present. | nothing |
'unsafe-eval' |
Permits eval(), new Function() and string-argument setTimeout. | nothing |
Reporting and hardening
| Directive | Purpose | Falls back to |
|---|---|---|
upgrade-insecure-requests |
Rewrites http:// subresource requests to https:// before they are made. | nothing |
report-to and report-uri |
Where the browser sends violation reports. | nothing |
require-trusted-types-for |
Forces dangerous DOM sinks to accept only typed, sanitised values. | nothing |