HeaderAudit

CSP img-src

Where images may be loaded from.

Falls back to
default-src
Group
Fetch directives

Detail

Usually the most permissive directive, since images are low risk. data: is commonly needed for inline SVG and base64 thumbnails. The residual concern is tracking: an injected image URL can beacon out to an attacker, which is why 'self' data: is better than *.

Example

img-src 'self' data: https:

Analyse a full policy → · Generate one →