Skip to main content

This tag is for the Content-Security-Policy HTTP header. For policies in companies, use [corporate-policy].

Content Security Policy is a HTTP header, designed to tell the browser what sources a website is allowed to request data from.

The following is an example of a Content Security Policy header:

script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https:;
object-src 'none';
base-uri 'none';

The header consists of several directives, such as default-src, script-src, object-src or style-src. Each of these directives defines where the corresponding content may be loaded from.

For example, style-src 'self' means that stylesheets may only be loaded from the same origin as the main document. img-src https: means that images can be included from anywhere, as long as the https schema is being used.

The Mozilla docs contain an in-depth article on the Content Security Policy header, its versions and its usage.