block-all-mixed-content

The block-all-mixed-content directive stops an HTTPS page from loading any subresource over plaintext http://. It blocks the request outright rather than upgrading it.

On an HTTPS page, it prevents any subresource request that would use http:// from being made, including passive content like images that browsers historically allowed. The request is blocked, not rewritten.

This differs from upgrade-insecure-requests, which rewrites the scheme to https:// and lets the request proceed if a secure version exists. Blocking breaks the resource; upgrading tries to load it securely.

Use the replacement instead:

Content-Security-Policy: upgrade-insecure-requests

Fallback chain

block-all-mixed-content has no fallback. default-src does not cover it, so it only applies when listed explicitly.

Values

None. It is a flag directive: its presence enables the behavior, and it takes no value.

Examples

Content-Security-Policy:
    default-src 'self';
    block-all-mixed-content

Security notes

The behavior this directive once added is now the browser default. Modern browsers block active mixed content (scripts, frames, fetches) automatically and upgrade or block passive mixed content (images, media) without any directive. Adding it changes little on a current browser, and it can break passive content that would otherwise be auto-upgraded.

Known bypasses and risks

Because it blocks rather than upgrades, a resource that has only an HTTP URL simply fails to load with no fallback. The directive does nothing for cross-origin top-level navigations. You can review a policy for redundant or deprecated directives with the CSP evaluator.

Recommendation

- Content-Security-Policy: block-all-mixed-content
+ Content-Security-Policy: upgrade-insecure-requests

Do not add block-all-mixed-content to new policies, and remove it from existing ones. Default mixed-content handling already blocks what it blocked, and upgrade-insecure-requests keeps legacy http:// references working by rewriting them instead of breaking them (MDN marks the directive deprecated).

Reporting

A request the directive blocks emits a csp-violation report naming block-all-mixed-content. On current browsers the default mixed-content handling usually intervenes first, so expect few reports from this directive itself.

Browser support

Historically supported across Chromium, Firefox, and Safari, but deprecated and largely superseded by default mixed-content handling. Prefer upgrade-insecure-requests.

See also

• upgrade-insecure-requests directive
• Content-Security-Policy header with Reporting-Endpoints
• CSP keywords and values

Sources

• MDN, CSP block-all-mixed-content
• W3C, Content Security Policy Level 3
• W3C, Mixed Content