---
title: "Content-Security-Policy · Meta Tag · zhead"
canonical_url: "https://zhead.dev/meta/content-security-policy"
last_updated: "2026-08-10T16:29:03.332Z"
meta:
  description: "Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs."
  "og:description": "Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs."
  "og:title": "Content-Security-Policy · Meta Tag · zhead"
---

Meta tags

# Content-Security-Policy

Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs.

## Parameters

default-src

Provides a fallback source list for fetch directives that are not set explicitly.

```
<meta http-equiv="Content-Security-Policy" content="default-src">
```

script-src

Lists allowed sources for JavaScript.

```
<meta http-equiv="Content-Security-Policy" content="script-src">
```

style-src

Lists allowed sources for stylesheets and style blocks.

```
<meta http-equiv="Content-Security-Policy" content="style-src">
```

img-src

Lists allowed image sources.

```
<meta http-equiv="Content-Security-Policy" content="img-src">
```

connect-src

Limits connections made by APIs such as fetch, XMLHttpRequest, WebSocket, and EventSource.

```
<meta http-equiv="Content-Security-Policy" content="connect-src">
```

font-src

Lists allowed font sources.

```
<meta http-equiv="Content-Security-Policy" content="font-src">
```

object-src

Lists allowed sources for object and embed elements. Set it to none when plugins are not needed.

```
<meta http-equiv="Content-Security-Policy" content="object-src">
```

media-src

Lists allowed audio and video sources.

```
<meta http-equiv="Content-Security-Policy" content="media-src">
```

frame-src

Lists allowed sources for nested browsing contexts such as iframes.

```
<meta http-equiv="Content-Security-Policy" content="frame-src">
```

## Code examples

Good example

```
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; base-uri 'self';">
```

Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin.

Good example

```
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-r4nd0m-per-response';">
```

Shows the shape of a nonce based script policy. Replace the example nonce with a new unpredictable value on every response.

Avoid this example

```
<meta http-equiv="Content-Security-Policy" content="default-src *;">
```

The wildcard leaves most network sources unrestricted and provides little useful protection.

Avoid this example

```
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline';">
```

Allowing every inline script removes a major CSP defence against injected JavaScript.

## Recommendations

- 01 Prefer an HTTP Response Header The response header supports the full CSP feature set and protects the document before any HTML is parsed. Use a meta policy only when you cannot set headers.
- 02 Place Meta Policies First A meta policy protects only content that follows it. Put it as early in the head as possible.
- 03 Know the Meta Limits Meta delivery does not support report-only mode or the report-uri, frame-ancestors, and sandbox directives.
- 04 Use a Fresh Nonce per Response When inline scripts are unavoidable, generate an unpredictable nonce for each response and apply it to the scripts you trust.

## Related documentation

- [w3c.github.io: Webappsec Csp](https://w3c.github.io/webappsec-csp/#meta-element)

## Related meta tags

### [Content-Security-Policy](https://zhead.dev/meta/content-security-policy)

http-equiv

Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs.

```
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; base-uri 'self';">
```

Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin.

### [content-type](https://zhead.dev/meta/content-type)

http-equiv

Provides the legacy pragma form of an HTML character encoding declaration. For conforming HTML, its content must be text/html; charset=utf-8.

```
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
```

The only conforming content value for this pragma in an HTML document.

### [default-style](https://zhead.dev/meta/default-style)

http-equiv

Selects the preferred CSS style sheet set by name when a page offers alternate titled stylesheets. Browser support is limited.

```
<meta http-equiv="default-style" content="Main Style">
```

Valid when a linked stylesheet set has the exact title Main Style.

### [refresh](https://zhead.dev/meta/refresh)

http-equiv

Reloads the current page after a delay or performs a timed redirect. Automatic navigation can confuse users, so a server redirect is usually a better choice.

```
<meta http-equiv="refresh" content="5; URL=https://example.com/next">
```

Valid timed redirect syntax. Prefer an HTTP redirect unless the visible delay serves a real purpose.

### [X-UA-Compatible](https://zhead.dev/meta/x-ua-compatible)

http-equiv

A legacy Internet Explorer pragma whose only conforming value is IE=edge. Current user agents must ignore it, so new pages should omit it.

```
<meta http-equiv="X-UA-Compatible" content="IE=edge">
```

The only value allowed by the HTML standard, kept here for reading legacy markup. Current browsers ignore it.