Directives

A Content Security Policy (CSP) is built from directives. Each directive names one resource type or behavior and sets the rule for it: which script hosts are allowed, who may frame the page, where the policy reports to. This page groups every directive by category and links each one to its own reference, so you can find the right directive for what you need to control.

For the rest of the policy syntax, see the values a directive accepts and the headers that deliver it.

Fetch directives

Fetch directives control where a page may load a given resource type from. They all take a space-separated source list (or 'none') and, unless noted below, fall back to default-src when you do not set them.

prefetch-src is deprecated and removed from Chromium, and fenced-frame-src is experimental and Chromium-only; the directive pages cover the current status of each.

Document directives

These directives govern properties of the document itself rather than a fetch. None of them fall back to default-src.

base-uri has no fallback, so omitting it leaves the page open to base-tag injection. sandbox takes sandbox tokens rather than a source list and cannot be set through a <meta> tag. plugin-types is deprecated; use object-src 'none' instead.

Navigation directives

Navigation directives restrict where the page may navigate and who may navigate to it. Neither falls back to default-src.

frame-ancestors is the anti-clickjacking directive and supersedes X-Frame-Options. It also cannot be set through a <meta> tag.

Reporting directives

Reporting directives say where the browser should send violation reports. They are configured per policy and have no fallback.

report-to references a group defined in the Reporting-Endpoints header. report-uri is the legacy mechanism and is ignored where report-to is supported. report-to recently became available across current Chrome, Firefox, and Safari, so keep report-uri only for old browser versions. See the CSP headers overview for how the wiring fits together.

WebRTC directives

WebRTC traffic is not covered by any fetch directive, so the spec draft adds a dedicated directive for it. It takes 'allow' or 'block' rather than a source list.

Other directives and Trusted Types

These directives do not fit the categories above. None fall back to default-src.

• upgrade-insecure-requests: a flag directive that rewrites insecure subresource and navigation URLs to HTTPS. It does not replace HSTS.
• block-all-mixed-content: a flag directive that blocks every HTTP subresource on an HTTPS page. It is deprecated, superseded by upgrade-insecure-requests and default mixed-content blocking.
• require-trusted-types-for: forces Trusted Types at DOM XSS sinks; its value is the token 'script'. Recently became available across current Chrome, Firefox, and Safari.
• trusted-types: an allowlist of Trusted Types policy names that constrains which policies the page may create. Recently became available across current Chrome, Firefox, and Safari.

Removed directives

Three directives were dropped from the platform without shipping and keep a short reference page each, since they still appear in old policies and blog posts.

A fourth, disown-opener, was dropped in favor of Cross-Origin-Opener-Policy and does not get a dedicated page. prefetch-src and plugin-types, listed above as deprecated, have their own pages too.

Fallback chains

When a directive is not set, the browser walks a chain to find a rule. The most common CSP mistake is assuming default-src covers everything; it does not cover the document, navigation, reporting, or Trusted Types directives, so each of those must be set explicitly.

The graph covers every directive that participates in a fallback chain. ⚠️ marks a deprecated directive, 🧪 an experimental one; the directives with no fallback are listed after the graph, and each directive page covers its exact status.

• script-src-elem and script-src-attr to script-src to default-src; the -attr variant skips -elem and falls back straight to script-src
• style-src-elem and style-src-attr to style-src to default-src, with the same skip
• frame-src to child-src to default-src
• worker-src to child-src to script-src to default-src; the child-src to script-src hop applies to worker loads only
• fenced-frame-src (experimental, Chromium-only) to frame-src to child-src to default-src
• connect-src, font-src, img-src, manifest-src, media-src, object-src, and the deprecated prefetch-src each fall back to default-src
• No fallback (set these explicitly): base-uri, form-action, frame-ancestors, sandbox, report-uri, report-to, upgrade-insecure-requests, block-all-mixed-content, require-trusted-types-for, trusted-types, webrtc

To check which directives a real policy is missing, run it through the CSP evaluator, or scan a live page for its headers with the CSP scanner.

See also

• What is CSP
• CSP values
• CSP headers
• CSP suite

Sources

• MDN, Content-Security-Policy
• W3C, Content Security Policy Level 3
• web.dev, Mitigate cross-site scripting with a strict CSP