# font-src (/en/docs/web-security/policies/content-security-policy/directives/font-src)



The `font-src` directive controls where fonts can load from under a Content Security Policy (CSP). It governs the font files requested by CSS `@font-face` rules, so it decides which origins, schemes, and inline data the browser will fetch a typeface from.

A minimal safe policy for this directive:

```http
Content-Security-Policy: font-src 'self' https://fonts.gstatic.com
```

## Fallback chain [#fallback-chain]

`font-src` falls back to [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src). If you do not set `font-src`, fonts are governed by whatever `default-src` allows. If neither is present, fonts load from anywhere.

## Values [#values]

`font-src` takes a space-separated source list combining [keyword sources](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), [host sources](/en/docs/web-security/policies/content-security-policy/values/csp-host-source), and [scheme sources](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source):

| Value               | Status  | Description                                                                          |
| ------------------- | ------- | ------------------------------------------------------------------------------------ |
| `'none'`            | ✅ Good  | Blocks all font loads; the page falls back to system typefaces.                      |
| `'self'`            | ✅ Good  | Fonts from the page's own origin only.                                               |
| `fonts.gstatic.com` | ✅ Good  | A named font host or CDN.                                                            |
| `https:`            | ✅ Good  | Any HTTPS origin. Broad; prefer named hosts.                                         |
| `data:`             | ✅ Good  | Inline `data:` URIs (icon fonts, embedded faces). A font cannot execute.             |
| `*`                 | ❌ Risky | Any host can receive font requests, a covert request channel. Never matches `data:`. |

Nonces and hashes do not apply to fonts.

## Examples [#examples]

```http
Content-Security-Policy:
  default-src 'self';
  font-src 'self' https://fonts.gstatic.com data:
```

This allows fonts from your own origin, a named font CDN, and inline `data:` URIs.

## Common use [#common-use]

Like [`img-src`](/en/docs/web-security/policies/content-security-policy/directives/img-src), `font-src` often needs `data:`. Icon-font libraries and many CSS frameworks inline glyphs as base64 `data:` URIs, and self-hosted font setups sometimes embed small faces directly in the stylesheet. Allowing `data:` here is low risk, since a font file cannot execute.

If you use a hosted font service, the font *files* usually come from a different host than the stylesheet. Google Fonts, for example, serves CSS from `fonts.googleapis.com` (a style host) but the actual `.woff2` files from `fonts.gstatic.com`, so that host belongs in `font-src` while the stylesheet host belongs in [`style-src`](/en/docs/web-security/policies/content-security-policy/directives/style-src).

## Security notes [#security-notes]

Fonts are a low-risk resource type. A blocked font falls back to a system typeface rather than breaking the page, and a font cannot run code, so `font-src` is a safe place to allow `data:` even under a strict policy. Verify the rest of the policy with the [CSP evaluator](/tools/csp-evaluator).

The directive still limits exfiltration: an attacker who can inject a `@font-face` rule could point it at an arbitrary host as a covert request channel, so keep `font-src` scoped to known hosts rather than `font-src *`.

## Known bypasses and risks [#known-bypasses-and-risks]

`font-src` is a content-integrity and exfiltration control, not an injection control, because fonts cannot execute. The main risk is an over-broad source list. A wildcard `*` does not match `data:`, so if a framework needs inline font data you must list `data:` explicitly even when `*` is present.

## Recommendation [#recommendation]

```http
Content-Security-Policy: font-src 'self' https://fonts.gstatic.com
```

Scope `font-src` to your own origin plus the font host you actually use. Add `data:` only when an icon-font library or framework inlines glyphs; it is low risk here because a font cannot execute. Avoid `*` and bare schemes, which turn font requests into a covert data channel.

## Reporting [#reporting]

When a font is blocked, the browser sends a [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) with `font-src` as the `effectiveDirective`, including the blocked URL. CentralCSP collects and aggregates these reports, so you can see every font host your pages actually load before you tighten the directive.

## Browser support [#browser-support]

`font-src` is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.

## See also [#see-also]

* [Content Security Policy directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives)
* [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src)
* [img-src](/en/docs/web-security/policies/content-security-policy/directives/img-src)
* [Scheme source values](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source)
* [CentralCSP CSP suite](/platform/csp-builder)

## Sources [#sources]

* [MDN, CSP font-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/font-src)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C CSP editor's draft](https://w3c.github.io/webappsec-csp/)