Content-Security-Policy (CSP) header
Baseline Widely available *
This feature is well established and works across many devices and browser versions. It’s been available across browsers since August 2016.
* Some parts of this feature may have varying levels of support.
The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints.
This helps guard against cross-site scripting attacks.
See the Content Security Policy (CSP) guide for details about how a CSP is delivered to the browser, what it looks like, along with use cases and deployment strategies.
| Header type | Response header |
|---|---|
| Forbidden request header | no |
Syntax
Content-Security-Policy: ;
where
Directives
Fetch directives
Fetch directives control the locations from which certain resource types may be loaded.
child-src-
Defines the valid sources for web workers and nested browsing contexts loaded using elements such as
and