HTTP headers

Content-Security-Policy HTTP Header Meaning

Content-Security-Policy restricts where page resources can load from.

Meaning

The server is sending browser-enforced rules for scripts, styles, images, frames, and other resource types.

Web apps send it to reduce script injection, clickjacking, mixed-content, and data exfiltration risks.

Check blocked resource reports, nonce or hash strategy, frame rules, and whether the policy is too broad.

Content-Security-Policy: default-src https:; img-src https: data:

default-src: default-src 'self'Fallback source list for fetch directives that are not set more specifically.
script-src: script-src 'self' https://cdn.exampleControls where JavaScript can load from and which inline script patterns may run.
style-src: style-src 'self' 'unsafe-inline'Controls where CSS can load from and how inline styles are handled.
img-src: img-src https: data:Controls where images can load from.
connect-src: connect-src 'self' https://api.exampleControls URLs used by fetch, XHR, WebSocket, EventSource, and similar APIs.
font-src: font-src https://fonts.exampleControls where fonts can load from.
frame-src: frame-src 'self'Controls which URLs this page may load into frames.
frame-ancestors: frame-ancestors 'none'Controls which parent pages can embed this page in a frame.
base-uri: base-uri 'self'Restricts which URLs may be used in a base element.
object-src: object-src 'none'Controls plugin-style object, embed, and applet resources.
report-to: report-to defaultNames a reporting endpoint group for policy violation reports.
report-uri: report-uri https://example.com/csp-reportSends policy violation reports to a URL; newer policies often use report-to.