# fenced-frame-src (/en/docs/web-security/policies/content-security-policy/directives/fenced-frame-src) The `fenced-frame-src` Content Security Policy (CSP) directive controls which sources may be loaded into a `` element. A fenced frame is an embedded context that is isolated from the page that hosts it, used by privacy-focused APIs such as Protected Audience and Shared Storage. `fenced-frame-src` is experimental and ships only in Chromium-based browsers. It is not Baseline and is not implemented in Firefox or Safari. The directive is tied to the still-evolving fenced frame privacy APIs, so its behavior and grammar can change between Chromium releases. Treat it as unstable and check the Browser support section before relying on it. A minimal policy for this directive, with the tightest value it accepts: ```http Content-Security-Policy: fenced-frame-src https: ``` ## Fallback chain [#fallback-chain] When `fenced-frame-src` is absent, the browser falls back to [`frame-src`](/en/docs/web-security/policies/content-security-policy/directives/frame-src), and then to [`child-src`](/en/docs/web-security/policies/content-security-policy/directives/child-src): ``` fenced-frame-src -> frame-src -> child-src ``` So a policy that already constrains `frame-src` also constrains fenced frames unless you set `fenced-frame-src` to a different value. ## Values [#values] `fenced-frame-src` accepts a restricted source list. Unlike other fetch directives, it only accepts the `https:` [scheme source](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source) and the wildcard `*`: | Value | Status | Description | | -------- | --------------- | ---------------------------------------------------------------------------- | | `https:` | 🧪 Experimental | Fenced frames from any HTTPS origin. The only scheme the directive accepts. | | `*` | 🧪 Experimental | Equivalent to `https:` here, since a fenced frame must be served over HTTPS. | Host sources, `'self'`, `'none'`, and nonce or hash sources are not accepted by this directive. ## Examples [#examples] A policy that pins ordinary frames to the page's own origin while still allowing fenced frames, which cannot be pinned tighter than `https:`: ```http Content-Security-Policy: frame-src 'self'; fenced-frame-src https: ``` Using `*` instead of `https:` is equivalent for this directive, since a fenced frame must be served over HTTPS regardless. ## Security notes [#security-notes] A fenced frame is already strongly isolated from the embedding page by design. `fenced-frame-src` lets a policy state, at the document level, whether fenced frames may be created at all and from which scheme, so a page that does not use the relevant APIs can decline them through its CSP. ## Known bypasses and risks [#known-bypasses-and-risks] Because the directive only accepts `https:` and `*`, it cannot restrict fenced frames to a specific host the way [`frame-src`](/en/docs/web-security/policies/content-security-policy/directives/frame-src) restricts ordinary frames. The feature is tied to evolving privacy APIs, so its exact behavior and the directive grammar can change between Chromium releases. ## Recommendation [#recommendation] ```http Content-Security-Policy: fenced-frame-src https: ``` Set `fenced-frame-src` only if your page actually uses fenced frames; `https:` is the tightest value it accepts. If you do not use them, add nothing, a tight `frame-src` already covers fenced frames through the fallback chain. Either way, keep `frame-src` as the real restriction, since this directive cannot pin hosts and only runs in Chromium. ## Reporting [#reporting] When a fenced frame is blocked in a supporting browser, it sends a [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) with `fenced-frame-src` as the `effectiveDirective`. CentralCSP collects and aggregates these reports alongside the rest of your CSP traffic, so you can watch this experimental surface without extra setup. ## Browser support [#browser-support] Chromium-based browsers only (Chrome, Edge, and Opera), and still experimental. Not implemented in Firefox or Safari, and not part of Baseline. Browsers that do not implement fenced frames ignore the directive. ## See also [#see-also] * [frame-src](/en/docs/web-security/policies/content-security-policy/directives/frame-src), the fallback and the directive for ordinary frames * [child-src](/en/docs/web-security/policies/content-security-policy/directives/child-src), the next fallback in the chain * [Evaluate a policy](/tools/csp-evaluator) with the CSP evaluator ## Sources [#sources] * [MDN, CSP fenced-frame-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src) * [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)