<zhead>
Meta tags

Content-Security-Policy

Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs.

Parameters

default-src
Provides a fallback source list for fetch directives that are not set explicitly.
<meta http-equiv="Content-Security-Policy" content="default-src">
script-src
Lists allowed sources for JavaScript.
<meta http-equiv="Content-Security-Policy" content="script-src">
style-src
Lists allowed sources for stylesheets and style blocks.
<meta http-equiv="Content-Security-Policy" content="style-src">
img-src
Lists allowed image sources.
<meta http-equiv="Content-Security-Policy" content="img-src">
connect-src
Limits connections made by APIs such as fetch, XMLHttpRequest, WebSocket, and EventSource.
<meta http-equiv="Content-Security-Policy" content="connect-src">
font-src
Lists allowed font sources.
<meta http-equiv="Content-Security-Policy" content="font-src">
object-src
Lists allowed sources for object and embed elements. Set it to none when plugins are not needed.
<meta http-equiv="Content-Security-Policy" content="object-src">
media-src
Lists allowed audio and video sources.
<meta http-equiv="Content-Security-Policy" content="media-src">
frame-src
Lists allowed sources for nested browsing contexts such as iframes.
<meta http-equiv="Content-Security-Policy" content="frame-src">
export type Content-Security-Policy =
     /**
   * Provides a fallback source list for fetch directives that are not set explicitly.
  **/
    'default-src'
    /**
   * Lists allowed sources for JavaScript.
  **/
    'script-src'
    /**
   * Lists allowed sources for stylesheets and style blocks.
  **/
    'style-src'
    /**
   * Lists allowed image sources.
  **/
    'img-src'
    /**
   * Limits connections made by APIs such as fetch, XMLHttpRequest, WebSocket, and EventSource.
  **/
    'connect-src'
    /**
   * Lists allowed font sources.
  **/
    'font-src'
    /**
   * Lists allowed sources for object and embed elements. Set it to none when plugins are not needed.
  **/
    'object-src'
    /**
   * Lists allowed audio and video sources.
  **/
    'media-src'
    /**
   * Lists allowed sources for nested browsing contexts such as iframes.
  **/
    'frame-src'

Code examples

Good example
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; base-uri 'self';">
Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin.
Good example
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-r4nd0m-per-response';">
Shows the shape of a nonce based script policy. Replace the example nonce with a new unpredictable value on every response.
Avoid this example
<meta http-equiv="Content-Security-Policy" content="default-src *;">
The wildcard leaves most network sources unrestricted and provides little useful protection.
Avoid this example
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline';">
Allowing every inline script removes a major CSP defence against injected JavaScript.

Recommendations

  • 01
    Prefer an HTTP Response Header
    The response header supports the full CSP feature set and protects the document before any HTML is parsed. Use a meta policy only when you cannot set headers.
  • 02
    Place Meta Policies First
    A meta policy protects only content that follows it. Put it as early in the head as possible.
  • 03
    Know the Meta Limits
    Meta delivery does not support report-only mode or the report-uri, frame-ancestors, and sandbox directives.
  • 04
    Use a Fresh Nonce per Response
    When inline scripts are unavoidable, generate an unpredictable nonce for each response and apply it to the scripts you trust.

Related documentation

Related meta tags

Content-Security-Policy

http-equiv

Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs.

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; base-uri 'self';">
Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin.

content-type

http-equiv

Provides the legacy pragma form of an HTML character encoding declaration. For conforming HTML, its content must be text/html; charset=utf-8.

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
The only conforming content value for this pragma in an HTML document.

default-style

http-equiv

Selects the preferred CSS style sheet set by name when a page offers alternate titled stylesheets. Browser support is limited.

<meta http-equiv="default-style" content="Main Style">
Valid when a linked stylesheet set has the exact title Main Style.

refresh

http-equiv

Reloads the current page after a delay or performs a timed redirect. Automatic navigation can confuse users, so a server redirect is usually a better choice.

<meta http-equiv="refresh" content="5; URL=https://example.com/next">
Valid timed redirect syntax. Prefer an HTTP redirect unless the visible delay serves a real purpose.

X-UA-Compatible

http-equiv

A legacy Internet Explorer pragma whose only conforming value is IE=edge. Current user agents must ignore it, so new pages should omit it.

<meta http-equiv="X-UA-Compatible" content="IE=edge">
The only value allowed by the HTML standard, kept here for reading legacy markup. Current browsers ignore it.