](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src)
  * [ ` font-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src)
  * [ ` frame-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src)
  * [ ` img-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src)
  * [ ` manifest-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/manifest-src)
  * [ ` media-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/media-src)
  * [ ` object-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src)
  * [ ` prefetch-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src)
  * [ ` script-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)
  * [ ` script-src-elem ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem)
  * [ ` script-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-attr)
  * [ ` style-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src)
  * [ ` style-src-elem ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-elem)
  * [ ` style-src-attr ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr)
  * [ ` worker-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src)

CSP version  |  1   
---|---  
Directive type  |  [ Fetch directive ](/en-US/docs/Glossary/Fetch_directive)  
  
##  Syntax

One or more sources can be allowed for the ` default-src ` policy:

http

    
    
    Content-Security-Policy: default-src <source>;
    Content-Security-Policy: default-src <source> <source>;
    

###  Sources

` <source> ` can be any one of the values listed in [ CSP Source Values ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources) .

Note that this same set of values can be used in all [ fetch directives ](/en-
US/docs/Glossary/Fetch_directive) (and a [ number of other directives ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#relevant_directives)
).

##  Examples

###  No inheritance with default-src

If there are other directives specified, ` default-src ` does not influence
them. The following header:

http

    
    
    Content-Security-Policy: default-src 'self'; script-src https://example.com
    

is the same as:

http

    
    
    Content-Security-Policy: connect-src 'self';
                             font-src 'self';
                             frame-src 'self';
                             img-src 'self';
                             manifest-src 'self';
                             media-src 'self';
                             object-src 'self';
                             script-src https://example.com;
                             style-src 'self';
                             worker-src 'self'
    

##  Specifications

Specification  
---  
[ Content Security Policy Level 3  
#  directive-default-src  ](https://w3c.github.io/webappsec-csp/#directive-
default-src)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * CSP directives ( [ https://www.w3.org/TR/CSP/#csp-directives ](https://www.w3.org/TR/CSP/#csp-directives) ): 
    * [ Fetch directive ](/en-US/docs/Glossary/Fetch_directive)
    * [ Document directive ](/en-US/docs/Glossary/Document_directive)
    * [ Navigation directive ](/en-US/docs/Glossary/Navigation_directive)
    * [ Reporting directive ](/en-US/docs/Glossary/Reporting_directive)
    * [ ` upgrade-insecure-requests ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests)
    * [ ` block-all-mixed-content ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/