Skip to content
Header Hawk

img-src

img-src specifies valid sources for images and favicons.

It is usually the noisiest fetch directive on a real site, because images come from everywhere: a CMS, a CDN, an avatar service, an analytics pixel, and data: URIs inlined by a build step.

Syntax

Section titled “Syntax”
Content-Security-Policy: img-src 'none';
Content-Security-Policy: img-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • <img>, and image requests made by the document generally, including favicons.

Fallback

Section titled “Fallback”

If img-src is absent, the browser consults default-src. The full chain is img-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: img-src 'self' data:
  • data: has to be listed explicitly - it is not covered by 'self', and inlined SVGs and build-time image placeholders are the usual reason a strict img-src breaks a page.
  • Resist img-src https:, which allows every image host on the web. It is a common shortcut and it removes most of the directive’s value; an allowlist of the four hosts you actually use is not much longer.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

An inlined placeholder, under img-src 'self' data::

<img src="data:image/svg+xml;base64,PHN2ZyB…" alt="" />

Blocked

Section titled “Blocked”

Under img-src 'self', a third-party pixel:

<img src="https://pixel.analytics.example/p.gif?id=42" width="1" height="1" />

Browser support

Section titled “Browser support”
  • Widely available across browsers since August 2016.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective img-src
effectiveDirective img-src
blockedUri https://pixel.analytics.example/p.gif, data
Issue title img-src blocking pixel.analytics.example
  • blockedUri: "data" is one issue for the whole site: HeaderHawk groups every data: violation under one signature per directive, because they are one decision - list data: or do not.
  • A long tail of one-off image hosts on this directive is usually user-generated content, not an attack. The noise classifier tags browser-extension origins, but a CMS embedding arbitrary hosts looks like real traffic because it is.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.