Directive: default src

Overview

The default-src directive serves as a fallback for the other CSP fetch directives (directives containing -src).

Required reading:

• Can I use default-src?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

default-src 'none'

default-src 'self'

default-src example.com

default-src example.com example.org

default-src https://*.example.com

default-src https:

default-src 'nonce-r4nd0m'

Fallbacks

✅ default-src is the fallback to all other directives with -src in the name.

Possible errors

• CSP-0100 — [ERROR] directive %s has an invalid value %s

For developers

ABNF (CSP3)

directive-name  = "default-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use default-src?