font-src
The CSP font-src directive controls where web fonts can load from, the font files requested by CSS at-font-face rules.
Last update:
The font-src directive controls where fonts can load from under a Content Security Policy (CSP). It governs the font files requested by CSS @font-face rules, so it decides which origins, schemes, and inline data the browser will fetch a typeface from.
A minimal safe policy for this directive:
Content-Security-Policy: font-src 'self' https://fonts.gstatic.comFallback chain
font-src falls back to default-src. If you do not set font-src, fonts are governed by whatever default-src allows. If neither is present, fonts load from anywhere.
Values
font-src takes a space-separated source list combining keyword sources, host sources, and scheme sources:
| Value | Status | Description |
|---|---|---|
'none' | ✅ Good | Blocks all font loads; the page falls back to system typefaces. |
'self' | ✅ Good | Fonts from the page's own origin only. |
fonts.gstatic.com | ✅ Good | A named font host or CDN. |
https: | ✅ Good | Any HTTPS origin. Broad; prefer named hosts. |
data: | ✅ Good | Inline data: URIs (icon fonts, embedded faces). A font cannot execute. |
* | ❌ Risky | Any host can receive font requests, a covert request channel. Never matches data:. |
Nonces and hashes do not apply to fonts.
Examples
Content-Security-Policy:
default-src 'self';
font-src 'self' https://fonts.gstatic.com data:This allows fonts from your own origin, a named font CDN, and inline data: URIs.
Common use
Like img-src, font-src often needs data:. Icon-font libraries and many CSS frameworks inline glyphs as base64 data: URIs, and self-hosted font setups sometimes embed small faces directly in the stylesheet. Allowing data: here is low risk, since a font file cannot execute.
If you use a hosted font service, the font files usually come from a different host than the stylesheet. Google Fonts, for example, serves CSS from fonts.googleapis.com (a style host) but the actual .woff2 files from fonts.gstatic.com, so that host belongs in font-src while the stylesheet host belongs in style-src.
Security notes
Fonts are a low-risk resource type. A blocked font falls back to a system typeface rather than breaking the page, and a font cannot run code, so font-src is a safe place to allow data: even under a strict policy. Verify the rest of the policy with the CSP evaluator.
The directive still limits exfiltration: an attacker who can inject a @font-face rule could point it at an arbitrary host as a covert request channel, so keep font-src scoped to known hosts rather than font-src *.
Known bypasses and risks
font-src is a content-integrity and exfiltration control, not an injection control, because fonts cannot execute. The main risk is an over-broad source list. A wildcard * does not match data:, so if a framework needs inline font data you must list data: explicitly even when * is present.
Recommendation
Content-Security-Policy: font-src 'self' https://fonts.gstatic.comScope font-src to your own origin plus the font host you actually use. Add data: only when an icon-font library or framework inlines glyphs; it is low risk here because a font cannot execute. Avoid * and bare schemes, which turn font requests into a covert data channel.
Reporting
When a font is blocked, the browser sends a csp-violation report with font-src as the effectiveDirective, including the blocked URL. CentralCSP collects and aggregates these reports, so you can see every font host your pages actually load before you tighten the directive.
Browser support
font-src is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.