# block-all-mixed-content (/en/docs/web-security/policies/content-security-policy/directives/block-all-mixed-content)



The `block-all-mixed-content` directive stops an HTTPS page from loading any subresource over plaintext `http://`. It blocks the request outright rather than upgrading it.

<Callout type="error" title="Deprecated">
  `block-all-mixed-content` is deprecated. Browsers now block active mixed content by default and auto-upgrade passive mixed content, so the directive is redundant. Use [`upgrade-insecure-requests`](/en/docs/web-security/policies/content-security-policy/directives/upgrade-insecure-requests) to rewrite insecure references to HTTPS instead. See [Browser support](#browser-support).
</Callout>

On an HTTPS page, it prevents any subresource request that would use `http://` from being made, including passive content like images that browsers historically allowed. The request is blocked, not rewritten.

This differs from [`upgrade-insecure-requests`](/en/docs/web-security/policies/content-security-policy/directives/upgrade-insecure-requests), which rewrites the scheme to `https://` and lets the request proceed if a secure version exists. Blocking breaks the resource; upgrading tries to load it securely.

Use the replacement instead:

```http
Content-Security-Policy: upgrade-insecure-requests
```

## Fallback chain [#fallback-chain]

`block-all-mixed-content` has no fallback. `default-src` does not cover it, so it only applies when listed explicitly.

## Values [#values]

None. It is a flag directive: its presence enables the behavior, and it takes no value.

## Examples [#examples]

```http
Content-Security-Policy:
    default-src 'self';
    block-all-mixed-content
```

## Security notes [#security-notes]

The behavior this directive once added is now the browser default. Modern browsers block active mixed content (scripts, frames, fetches) automatically and upgrade or block passive mixed content (images, media) without any directive. Adding it changes little on a current browser, and it can break passive content that would otherwise be auto-upgraded.

## Known bypasses and risks [#known-bypasses-and-risks]

Because it blocks rather than upgrades, a resource that has only an HTTP URL simply fails to load with no fallback. The directive does nothing for cross-origin top-level navigations. You can review a policy for redundant or deprecated directives with the [CSP evaluator](/tools/csp-evaluator).

## Recommendation [#recommendation]

```diff
- Content-Security-Policy: block-all-mixed-content
+ Content-Security-Policy: upgrade-insecure-requests
```

Do not add `block-all-mixed-content` to new policies, and remove it from existing ones. Default mixed-content handling already blocks what it blocked, and [`upgrade-insecure-requests`](/en/docs/web-security/policies/content-security-policy/directives/upgrade-insecure-requests) keeps legacy `http://` references working by rewriting them instead of breaking them (MDN marks the directive deprecated).

## Reporting [#reporting]

A request the directive blocks emits a [`csp-violation` report](/en/docs/web-security/reporting-api/reports/csp-violation) naming `block-all-mixed-content`. On current browsers the default mixed-content handling usually intervenes first, so expect few reports from this directive itself.

## Browser support [#browser-support]

Historically supported across Chromium, Firefox, and Safari, but deprecated and largely superseded by default mixed-content handling. Prefer `upgrade-insecure-requests`.

## See also [#see-also]

* [upgrade-insecure-requests directive](/en/docs/web-security/policies/content-security-policy/directives/upgrade-insecure-requests)
* [Content-Security-Policy header with Reporting-Endpoints](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [CSP keywords and values](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)

## Sources [#sources]

* [MDN, CSP block-all-mixed-content](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C, Mixed Content](https://www.w3.org/TR/mixed-content/)