# object-src (/en/docs/web-security/policies/content-security-policy/directives/object-src)



The `object-src` directive controls plugin content under a Content Security Policy (CSP). It governs `<object>` and `<embed>` elements, which can load plugins, Flash, PDFs, and other embedded content that historically ran in the page's context.

A minimal safe policy for this directive:

```http
Content-Security-Policy: object-src 'none'
```

## Fallback chain [#fallback-chain]

`object-src` falls back to [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src). If you do not set `object-src`, plugin content is governed by whatever `default-src` allows. If neither is present, it loads from anywhere.

## Values [#values]

`object-src` takes a space-separated source list combining [keyword sources](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), [host sources](/en/docs/web-security/policies/content-security-policy/values/csp-host-source), and [scheme sources](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source):

| Value                 | Status  | Description                                                                       |
| --------------------- | ------- | --------------------------------------------------------------------------------- |
| `'none'`              | ✅ Good  | Blocks all plugin content. The recommended value.                                 |
| `'self'`              | ✅ Good  | Same-origin plugin content only. Prefer `'none'` unless you embed something.      |
| `plugins.example.com` | ✅ Good  | The exact host of a resource you must embed.                                      |
| `https:`              | ❌ Risky | Plugin content from any HTTPS host; re-opens the injection sink.                  |
| `data:`               | ❌ Risky | An attacker-controlled `data:` URL can carry active plugin content that executes. |
| `blob:`               | ❌ Risky | Lets injected script construct plugin content client-side.                        |
| `*`                   | ❌ Risky | No protection at all for this sink. Never matches `data:` or `blob:`.             |

Nonces and hashes do not apply.

## Examples [#examples]

```http
Content-Security-Policy:
  default-src 'self';
  object-src 'none';
  base-uri 'none'
```

Here plugin content is blocked entirely, which is the recommended setting for almost every site.

## Common use [#common-use]

The standard value is `object-src 'none'`. Plugin embeds are an injection sink: an attacker who can place an `<object>` or `<embed>` element can sometimes load active content that executes in the page. Because modern browsers have dropped plugin support and `<embed>`/`<object>` are rarely needed, blocking them outright costs nothing on most sites and closes a real attack surface. `object-src 'none'` is one of the directives a strict CSP always includes, alongside a nonce or hash on [`script-src`](/en/docs/web-security/policies/content-security-policy/directives/script-src) and `base-uri 'none'`.

The now-removed `plugin-types` directive used to restrict plugin MIME types. It has been dropped from CSP Level 3 and from browsers; use `object-src 'none'` instead. You can confirm a strict policy includes it with the [CSP evaluator](/tools/csp-evaluator).

## Security notes [#security-notes]

Unlike images or fonts, plugin content can carry executable behavior, so `object-src` is a genuine injection control, not just a content control. There is rarely a reason to allow it. If you must embed a specific plugin resource, scope `object-src` to the exact host rather than relaxing it broadly.

## Known bypasses and risks [#known-bypasses-and-risks]

Leaving `object-src` unset (and relying on a permissive `default-src`) leaves the plugin sink open, which is why strict-CSP guidance names `object-src 'none'` explicitly. Any value broader than the specific hosts you actually embed re-opens the sink. A wildcard `object-src *` is effectively no protection at all for this resource type.

## Recommendation [#recommendation]

```http
Content-Security-Policy: object-src 'none'
```

Block plugin content entirely. `object-src 'none'` is part of the strict policy recommended by the [OWASP CSP cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) and [web.dev's strict CSP guidance](https://web.dev/articles/strict-csp). Modern sites almost never need `<object>` or `<embed>`, so this closes an injection sink at no cost.

## Reporting [#reporting]

When plugin content is blocked, the browser sends a [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) with `object-src` as the `effectiveDirective`, including the blocked URL. CentralCSP collects and aggregates these reports, so an unexpected `object-src` violation surfaces immediately, which usually means injected markup.

## Browser support [#browser-support]

`object-src` is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.

## FAQ [#faq]

### Why set object-src to none? [#why-set-object-src-to-none]

`<object>` and `<embed>` are an injection sink: an attacker who places one can sometimes load active content that executes in the page. Modern browsers have dropped plugin support, so `object-src 'none'` closes that surface at no cost and is one directive every strict CSP includes.

### What does object-src control? [#what-does-object-src-control]

`object-src` governs plugin content loaded through `<object>` and `<embed>` elements, historically Flash, PDFs, and other embedded content that ran in the page's context. It does not accept nonces or hashes. If you do not set it, plugin content falls back to `default-src`.

## See also [#see-also]

* [Content Security Policy directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives)
* [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src)
* [script-src](/en/docs/web-security/policies/content-security-policy/directives/script-src)
* [base-uri](/en/docs/web-security/policies/content-security-policy/directives/base-uri)
* [CSP keyword values](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)
* [CentralCSP CSP suite](/platform/csp-builder)

## Sources [#sources]

* [MDN, CSP object-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/object-src)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C CSP editor's draft](https://w3c.github.io/webappsec-csp/)
* [OWASP, Content Security Policy cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)
* [web.dev, Mitigate XSS with a strict CSP](https://web.dev/articles/strict-csp)