Skip to content
Header Hawk

default-src

default-src is the fallback for the fetch directives. It does not apply to a resource type that has its own directive in the policy - it fills the gap left by the ones you did not write.

That makes it the first directive to set and the last one to trust. A policy of default-src 'self' covers scripts, styles, images, fonts, connections, frames and workers in one line; a policy of default-src 'self'; script-src https://cdn.example.com covers scripts from the CDN only, because script-src replaces the fallback rather than adding to it.

Syntax

Section titled “Syntax”
Content-Security-Policy: default-src 'none';
Content-Security-Policy: default-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • Any fetch directive absent from the policy: child-src, connect-src, font-src, frame-src, img-src, manifest-src, media-src, object-src, script-src, script-src-elem, script-src-attr, style-src, style-src-elem, style-src-attr and worker-src.

What it does not control

Section titled “What it does not control”
  • base-uri, form-action, frame-ancestors and sandbox. None of them fall back to default-src, so default-src 'none' still leaves your page embeddable by anyone and your forms free to post anywhere.
  • report-uri, report-to, upgrade-insecure-requests, require-trusted-types-for and trusted-types, which take no source list.

Fallback

Section titled “Fallback”

default-src is the fallback. Nothing stands behind it: a resource type whose own directive is absent and which default-src does not cover is unrestricted.

Section titled “Recommended value”
Content-Security-Policy: default-src 'self'
  • It is the smallest policy that means something, and every violation it produces names a resource type you have not yet written a directive for.
  • Tightening to default-src 'none' is the end state, not the starting point: it only makes sense once every resource type your pages use has its own directive.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

Same-origin resources of every type, with no other directive set:

Content-Security-Policy: default-src 'self'

Blocked

Section titled “Blocked”

A same-origin stylesheet, because style-src replaced the fallback rather than extending it:

Content-Security-Policy: default-src 'self'; style-src https://cdn.example.com

Browser support

Section titled “Browser support”
  • Widely available across browsers since August 2016.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective default-src
effectiveDirective default-src
blockedUri https://cdn.example.com/widget.js, inline, data
Issue title default-src blocking cdn.example.com
  • Browsers name the directive that was actually consulted. If your policy sets script-src, a blocked script reports script-src (or script-src-elem), not default-src - so a default-src issue in HeaderHawk is a resource type your policy never named explicitly.
  • Treat a run of default-src issues as a worklist: each distinct blocked host is a resource type that wants its own directive.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.