The default-src directive specifies the security policy for types of content that are not specifically defined by their own directives. This includes, child-src, connect-src, font-src, img-src, media-src, object-src, script-src and style-src.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.
• Data - Matches the data: URI as a content source.
• Unsafe Inline - Allows the use of inline resources such as <script> and <style> elements.
• Unsafe Eval - Allows the use of methods such as eval() to interpret code from strings.

The script-src directive specifies valid sources for JavaScript. This directive falls back to default-src if not specified. When either script-src or default-src are present the use of inline script and eval() is blocked without the addition of Unsafe Inline and Unsafe Eval respectively.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.
• Data - Matches the data: URI as a content source.
• Unsafe Inline - Allows the use of inline resources such as <script> and <style> elements.
• Unsafe Eval - Allows the use of methods such as eval() to interpret code from strings.

The style-src directive specifies valid sources for stylesheets. This directive falls back to default-src if not specified. When either style-src or default-src are present the use of inline <style> elements and HTML style attributes are disabled unless you specify Unsafe Inline.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.
• Data - Matches the data: URI as a content source.
• Unsafe Inline - Allows the use of inline resources such as <script> and <style> elements.

The img-src directive specifies valid sources for images and favicons. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.
• Data - Matches the data: URI as a content source.

The font-src directive specifies valid sources for fonts loaded using @font-face. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.
• Data - Matches the data: URI as a content source.

The connect-src directive specifies valid sources for fetch, XMLHttpRequest, WebSocket and EventSource connections. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The media-src directive specifies valid sources for the <audio> and <video> elements. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The object-src directive specifies valid sources for the <object>, <embed> and <applet> elements. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The child-src directive specifies valid sources for elements such as <frame> and <iframe>. This directive falls back to default-src if not specified and is preferred over the frame-src directive which is deprecated.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

http://report-uri.io:* Matches any any port on report-uri.io using HTTP.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The frame-src directive specifies valid sources for elements such as <frame> and <iframe>. This directive falls back to child-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The worker-src directive specifies valid sources for Worker, Sharedworker or ServiceWorker. This directive falls back to child-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The frame-ancestors directive specifies parents thay may embed a page using elements such as <frame> and <iframe>. It replaces the X-Frame-Options header.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The form-action directive specifies locations that can be used for <form> submissions.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

This directive forces a user agent to load all assets over HTTPS, even if the URL specifies HTTP, when the page is loaded using HTTPS. It is ignored in a Report-Only policy.

• Enable - Activates the directive.

This directive prevents a user agent from loading any assets using HTTP when the page is loaded using HTTPS. It is ignored in a Report-Only policy.

• Enable - Activates the directive.

This directive ensures that a resource disowns its opener when navigated to.

• Enable - Activates the directive.

The sandbox directive applies restrictions to a page including the prevention of popups, plugins, scripts and enforcing a same-origin policy.

• Enable - This enables sandbox protection with all restrictions in place. Further values can be specified to disable particular restrictions.
• Allow Popups - Allows popups.
• Allow Top Navigation - Allows content to navigate and close their top-level browsing context.
• Allow Same Origin - Allows content to access other content from the same origin.
• Allow Forms - Allows form submissions.
• Allow Pointer Lock - Enables the Pointer Lock API.
• Allow Scripts - Allows script execution.

The reflected-xss directive configures the built in heuristics a user agent has to filter or block reflected XSS attacks.

• Allow - Allows reflected XSS attacks.
• Block - Block reflected XSS attacks.
• Filter - Filter the reflected XSS attack.

This directive requires the use of SRI for Scripts or Styles on the page.

• Script - Require SRI for scripts.
• Style - Require SRI for styles.

The base-uri directive specifies URIs that a user agent may use as the documents base URL for relative URIs.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

The manifest-src directive specifies which manifest can be applied to the resource. This directive falls back to default-src if not specified.

Valid host expressions can include:

https://*.report-uri.io Matches all subdomains of report-uri.io using the HTTPS scheme but not report-uri.io itself.

www.report-uri.io:443 Matches www.report-uri.io only on port 443 using any scheme.

https://report-uri.io:* Matches any any port on report-uri.io using HTTPS.

• None - Blocks the use of this resource type.
• All - Allows all origins for this resource.
• Self - Matches the current origin but not subdomains.

The plugin-type directive specifies the allowed plugins that the user agent may invoke.

The referrer directive specifies information for the referrer header in links away from the page.

• No Referrer - Prevents the UA sending a referrer header.
• No Referrer When Downgrade - Prevents the UA sending a referrer header when navigating from https to http.
• Origin Only - Allows the UA to only send the origin in the referrer header.
• Origin When Cross Origin - Allows the UA to only send the origin in the referrer header when making cross-origin requests.
• Unsafe URL - Allows the UA to send the full URL in the referrer header with same-origin and cross-origin requests. This is unsafe.

The Report Only flag marks the CSP header in report only mode. The user agent will deliver violation reports but not enforce the policy. Used for testing purposes.

The report-uri directive specifies the URI that the user agent will POST a JSON formatted violation report to should the CSP be violated.

The report-to directive specifies a token that the user agent will use to lookup the reporting group in the report-to header.