CSP font-src

Where fonts may be loaded from.

Falls back to

default-src

Group

Fetch directives

Detail

Low risk. Worth setting narrowly only because self-hosting fonts is now the norm for privacy reasons, so a broad value usually indicates a third-party font service nobody remembers adding.

Example

Analyse a full policy → · Generate one →