Skip to content
Header Hawk

font-src

font-src specifies valid sources for fonts loaded by @font-face.

Font violations rarely arrive alone. A hosted font service needs its stylesheet host in style-src and its font host in font-src, and the two are usually different origins - which is why the first attempt at a strict policy tends to break the typography and nothing else.

Syntax

Section titled “Syntax”
Content-Security-Policy: font-src 'none';
Content-Security-Policy: font-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • Fonts requested by an @font-face rule’s src.

Fallback

Section titled “Fallback”

If font-src is absent, the browser consults default-src. The full chain is font-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: font-src 'self'
  • Self-hosting fonts removes the directive problem and a third-party dependency at once.
  • If you use a font service, list its font origin here and its stylesheet origin in style-src - for Google Fonts those are https://fonts.gstatic.com and https://fonts.googleapis.com respectively.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

A self-hosted font, under font-src 'self':

@font-face {
  font-family: "Inter";
  src: url("/assets/inter.woff2") format("woff2");
}

Blocked

Section titled “Blocked”

Under font-src 'self':

@font-face {
  font-family: "Inter";
  src: url("https://fonts.gstatic.com/s/inter/v13/…woff2") format("woff2");
}

Browser support

Section titled “Browser support”
  • Widely available across browsers since August 2016.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective font-src
effectiveDirective font-src
blockedUri https://fonts.gstatic.com/s/inter/v13/font.woff2, data
Issue title font-src blocking fonts.gstatic.com
  • The report names the font file, not the stylesheet that asked for it. sourceFile on the report detail is the stylesheet - that is the field to read when you cannot work out who wants the font.
  • data: fonts are a real pattern in icon libraries and produce a single font-src data: URI issue.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.