CSP: default-src

The HTTP Content-Security-Policy (CSP) default-src directive serves as a fallback for the other CSP fetch directives. For each of the following directives that are absent, the user agent looks for the default-src directive and uses this value for it:

CSP version 1
Directive type Fetch directive

Syntax

One or more sources can be allowed for the default-src policy:

Content-Security-Policy: default-src <source>;
Content-Security-Policy: default-src <source> <source>;

Sources

<source> can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples

No inheritance with default-src

If there are other directives specified, default-src does not influence them. The following header:

Content-Security-Policy: default-src 'self'; script-src https://example.com

is the same as:

Content-Security-Policy: connect-src 'self';
                         font-src 'self';
                         frame-src 'self';
                         img-src 'self';
                         manifest-src 'self';
                         media-src 'self';
                         object-src 'self';
                         script-src https://example.com;
                         style-src 'self';
                         worker-src 'self'

Specifications

Specification
Content Security Policy Level 3
# directive-default-src

Browser compatibility

BCD tables only load in the browser

See also