HeaderAudit
Home / CSP directives / object-src

CSP object-src

Plugin content. Should be 'none' on essentially every site.

Falls back to
default-src
Group
Fetch directives

Detail

, and can execute script in some configurations, which makes this a genuine bypass route on policies that otherwise look tight. Practically no modern site needs plugin content, so object-src 'none' is close to free security and should be set explicitly rather than left to default-src.

Example

object-src 'none'

Analyse a full policy → · Generate one →