CSP Directive Reference

Every CSP directive has its own page here: what it controls, its fallback chain, a recommended value, allowed and blocked examples, its browser support, and what a HeaderHawk report looks like when it fires.

If you are writing your first policy, start with CSP Concepts and come back. If you are reading a violation report and want to know what the directive in it means, find it below.

Source expressions - 'self', 'none', 'unsafe-inline', 'strict-dynamic', nonces, hashes and schemes - are shared across directives and live on one page: CSP Keywords & Source Expressions.

Fetch Directives

Control where a document may load a given kind of resource from. These are the directives almost every violation report names.

Directive	Controls	Status
`default-src`	Fallback for every fetch directive you did not write	Current
`script-src`	Which JavaScript may run, from anywhere	Current
`script-src-elem`	`<script>` elements only	Current
`script-src-attr`	Inline event handler attributes only	Current
`style-src`	All CSS: stylesheets, blocks and attributes	Current
`style-src-elem`	`<style>` elements and linked stylesheets	Current
`style-src-attr`	Inline `style` attributes only	Current
`img-src`	Images and favicons	Current
`font-src`	Fonts fetched by `@font-face`	Current
`connect-src`	`fetch`, XHR, WebSocket, `EventSource`, `sendBeacon`	Current
`media-src`	`<audio>`, `<video>` and `<track>` sources	Current
`object-src`	`<object>` and `<embed>` content	Current
`frame-src`	What this page may embed in an iframe	Current
`child-src`	Shared fallback behind `frame-src` and `worker-src`	Current
`worker-src`	Worker, SharedWorker and ServiceWorker scripts	Current
`manifest-src`	The web app manifest	Current

Document Directives

Control properties of the document itself rather than the resources it loads.

Directive	Controls	Status
`base-uri`	What a `<base>` element may set the base URL to	Current
`sandbox`	Sandboxes the response itself, iframe-style	Current

Control where the document may send the user, and who may embed it.

Directive	Controls	Status
`form-action`	Where forms may submit	Current
`frame-ancestors`	Who may embed this page in a frame	Current

Reporting Directives

Say where violation reports go. Neither is ever the subject of a violation.

Directive	Controls	Status
`report-uri`	Where violation reports are posted	Deprecated
`report-to`	Where reports go, via `Reporting-Endpoints`	Current

Other Directives

Directives that take no source list and change how the whole document behaves.

Directive	Controls	Status
`upgrade-insecure-requests`	Rewrites `http://` subresources to `https://`	Current
`require-trusted-types-for`	Makes DOM XSS sinks reject plain strings	Current
`trusted-types`	Which Trusted Types policies may be created	Current

Deprecated & Removed

Directives you will still find in policies and blog posts, and what to write instead.

Directive	Controls	Status
`block-all-mixed-content`	Blocked all mixed content; now obsolete	Deprecated
`plugin-types`	Restricted plugin MIME types; removed from browsers	Removed
`navigate-to`	Would have restricted navigation; never shipped	Removed

Directives without a page

Four directives turn up in CSP reference tables - including earlier versions of this one - that are not documented here, because none of them has behaviour worth a page:

prefetch-src is deprecated and non-standard. It was never defined in a specification and no browser ships it. Prefetch and prerender requests are governed by the directive matching the resource being fetched.
fenced-frame-src is experimental and pending removal. Chrome withdrew the <fencedframe> element it existed for. It fell back to frame-src, then child-src.
referrer was a non-standard Chromium experiment, removed years ago. Use the Referrer-Policy response header.
require-sri-for was another, also removed. Use Subresource Integrity attributes on the elements themselves.

Common policies

Strict

The end state for an application that emits a nonce per response. Note that base-uri, form-action and frame-ancestors are written out: none of them inherits from default-src.

Content-Security-Policy: default-src 'none'; script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests; report-uri https://ingest.headerhawk.com/csp/YOUR_INGEST_CODE; report-to csp-endpoint

Moderate

A realistic starting point for an existing site, in report-only mode. It will produce violations; that is the point.

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.example.com; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; report-uri https://ingest.headerhawk.com/csp/YOUR_INGEST_CODE

Browser support at a glance

CSP Level 2 is universal. These are the Level 3 features whose support is recent enough to matter when you write a policy:

Feature	Status
`'strict-dynamic'`	Widely available
`script-src-elem`, `script-src-attr`, `style-src-attr`	Widely available since December 2022
`style-src-elem`	Newly available since December 2025 - later than its `-attr` sibling
`trusted-types`, `require-trusted-types-for`	Newly available since February 2026; Chromium-only before that
`report-to`	Newly available since March 2026 - keep `report-uri` alongside it

“Newly available” means the latest version of every major browser supports it, and older versions do not. Every one of these degrades by being ignored, so a policy that also carries the older equivalent is safe in both.