yle-src) ).

CSP version  |  3   
---|---  
Directive type  |  [ Fetch directive ](/en-US/docs/Glossary/Fetch_directive)  
[ ` default-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src) fallback  |  Yes. If this directive is absent, the user agent will look for the [ ` style-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src) directive, and if both of them are absent, fall back to ` default-src ` directive.   
  
##  Syntax

One or more sources can be allowed for the ` style-src-elem ` policy:

http

    
    
    Content-Security-Policy: style-src-elem <source>;
    Content-Security-Policy: style-src-elem <source> <source>;
    

` style-src-elem ` can be used in conjunction with [ ` style-src ` ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src) :

http

    
    
    Content-Security-Policy: style-src <source>;
    Content-Security-Policy: style-src-elem <source>;
    

###  Sources

` <source> ` can be any one of the values listed in [ CSP Source Values ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources) .

Note that this same set of values can be used in all [ fetch directives ](/en-
US/docs/Glossary/Fetch_directive) (and a [ number of other directives ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#relevant_directives)
).

##  Examples

###  Violation cases

Given this CSP header:

http

    
    
    Content-Security-Policy: style-src-elem https://example.com/
    

â¦the following stylesheets are blocked and won't load:

html

    
    
    <link href="https://not-example.com/styles/main.css" rel="stylesheet" />
    
    <style>
      #inline-style {
        background: red;
      }
    </style>
    
    <style>
      @import url("https://not-example.com/styles/print.css") print;
    </style>
    

â¦as well as styles loaded using the [ ` Link ` ](/en-
US/docs/Web/HTTP/Headers/Link) header:

http

    
    
    Link: <https://not-example.com/styles/stylesheet.css>;rel=stylesheet
    

##  Specifications

Specification  
---  
[ Content Security Policy Level 3  
#  directive-style-src-elem  ](https://w3c.github.io/webappsec-csp/#directive-
style-src-elem)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * [ ` style-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src)
  * [ ` style-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr)
  * [ ` Link ` ](/en-US/docs/Web/HTTP/Headers/Link) header 
  * [ ` <style> ` ](/en-US/docs/Web/HTML/Element/style) , [ ` <link> ` ](/en-US/docs/Web/HTML/Element/link)
  * [ ` @import ` ](/en-US/docs/Web/CSS/@import)
  * [ ` CSSStyleSheet.insertRule() ` ](/en-US/docs/Web/API/CSSStyleSheet/insertRule)
  * [ ` CSSGroupingRule.insertRule() ` ](/en-US/docs/Web/API/CSSGroupingRule/insertRule)
  * [ ` CSSStyleDeclaration.cssText ` ](/en-US/docs/Web/API/CSSStyleDeclaration/cssText)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  Apr 10, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-
elem/contributors.txt) .

[ View this page on GitHub
](https://github.com/mdn/content/blob/main/files/en-
us/web/http/headers/content-security-policy/style-src-elem/index.md?plain=1
"Folder: en-us/web/http/headers/content-security-policy/style-src-elem \(Opens
in a new tab\)") â¢  [ Report a problem with this content
](https://github.com/mdn/content/issues/new?template=page-report.yml&mdn-
url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Fstyle-src-
elem&metadata=%3C%21--+Do+not+make+changes+below