# prefetch-src (/en/docs/web-security/policies/content-security-policy/directives/prefetch-src) The `prefetch-src` Content Security Policy (CSP) directive was intended to control the sources a page could prefetch or prerender. It was only ever shipped in Chromium, never standardized, and has since been removed. `prefetch-src` is deprecated and non-standard. It was never part of the CSP specification, shipped only in Chromium, and has been removed: rather than standardize a separate directive, the platform governs speculative loads through the existing fetch directives. There is no replacement directive. Remove it from your policy; it has no effect in current browsers. ## What you should do instead [#what-you-should-do-instead] There is no successor directive for prefetch and prerender sources. Prefetched and prerendered resources are governed by the directive that matches the resource type once it loads (for example [`script-src`](/en/docs/web-security/policies/content-security-policy/directives/script-src) for scripts or `img-src` for images), and by Speculation Rules where they apply. Delete `prefetch-src` from any policy that still carries it. Keeping it does no harm beyond noise, but it controls nothing. A policy needs no prefetch-specific directive; the ordinary fetch directives already govern each prefetched resource when it loads: ```http Content-Security-Policy: script-src 'self'; img-src 'self' ``` ## Why it was removed [#why-it-was-removed] `prefetch-src` was a Chromium-only addition that never reached the CSP specification or other browser engines. Rather than standardize a separate directive, the platform settled on governing speculative loads through the existing fetch directives, so `prefetch-src` was dropped. ## Browser support [#browser-support] No current browser enforces `prefetch-src`. It was present in older Chromium versions only and has been removed. Firefox and Safari never implemented it. ## See also [#see-also] * [script-src](/en/docs/web-security/policies/content-security-policy/directives/script-src), which governs prefetched scripts once they load * [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src), the fallback for fetch directives * [Evaluate a policy](/tools/csp-evaluator) with the CSP evaluator ## Sources [#sources] * [MDN, CSP prefetch-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/prefetch-src) * [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)