# plugin-types (/en/docs/web-security/policies/content-security-policy/directives/plugin-types)



The `plugin-types` Content Security Policy (CSP) directive once restricted the set
of MIME types a page could load through plugin elements such as `<object>` and
`<embed>`. Browser plugins have been retired, so the directive was dropped from
the specification and removed from browsers.

<Callout type="error" title="Deprecated">
  `plugin-types` is deprecated and has been removed. Browsers retired plugin support entirely, which left the directive nothing to govern, so it was dropped from CSP Level 3 and removed from Chromium. To block plugin content, set [`object-src 'none'`](/en/docs/web-security/policies/content-security-policy/directives/object-src) instead.
</Callout>

Use the replacement instead:

```http
Content-Security-Policy: object-src 'none'
```

## What you should do instead [#what-you-should-do-instead]

Use [`object-src`](/en/docs/web-security/policies/content-security-policy/directives/object-src)
to control plugin content. Setting it to `'none'`, as in the example above,
blocks `<object>`, `<embed>`, and the legacy `<applet>` outright, which is the
recommended strict-CSP default and covers what `plugin-types` was meant to
restrict.

This is more direct than allowlisting MIME types: there is no longer a reason to
permit any plugin type on the modern web, so block them all.

## Why it was removed [#why-it-was-removed]

`plugin-types` existed to allowlist plugin MIME types back when browsers ran NPAPI
and similar plugins. Browsers have since removed plugin support entirely, so a
directive that allowlisted plugin types had nothing left to govern. CSP Level 3
dropped it, and Chromium removed it.

## Browser support [#browser-support]

No current browser enforces `plugin-types`. It was removed from Chromium and was
never part of CSP Level 3. Use
[`object-src 'none'`](/en/docs/web-security/policies/content-security-policy/directives/object-src)
in its place.

## See also [#see-also]

* [object-src](/en/docs/web-security/policies/content-security-policy/directives/object-src), the directive to use instead
* [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src), the fallback that object-src defers to
* [Evaluate a policy](/tools/csp-evaluator) with the CSP evaluator

## Sources [#sources]

* [MDN, CSP plugin-types](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/plugin-types)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)