Reference Guide

CSP Cheat Sheet

A quick reference for Content Security Policy directives and keywords to help you secure your web applications.

Core Directives

default-src

The fallback for other fetch directives.

default-src 'self';

script-src

Specifies valid sources for JavaScript.

script-src 'self' https://trusted.com;

style-src

Specifies valid sources for stylesheets.

style-src 'self' 'unsafe-inline';

img-src

Specifies valid sources for images.

img-src 'self' data: https:;

connect-src

Restricts URLs which can be loaded using script interfaces (APIs).

connect-src 'self' https://api.example.com;

frame-src

Specifies valid sources for nested browsing contexts (iframes).

frame-src 'self' https://www.youtube.com;

Common Keywords

'self'— Matches the origin of the current page.

Includes same scheme, host, and port.

'none'— Blocks all sources.

Useful for directives like object-src to disable Flash/Plugins.

'unsafe-inline'— Allows inline scripts/styles.

⚠️ Significant security risk. Use nonces or hashes instead.

https:— Allows any source via HTTPS.

Matches any URL with the https:// scheme.

Need a Policy Fast?

Use our Policy Builder to generate a secure CSP based on your actual site traffic.

Start for Free

Best Practice Policies

Strict (Recommended)

default-src 'none'; script-src 'self' 'nonce-random'; style-src 'self'; img-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self';

Moderate (Common)

default-src 'self'; script-src 'self' https://trusted.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' https://fonts.gstatic.com;

Reporting Only

# Use this as an HTTP Header:
Content-Security-Policy-Report-Only:
default-src 'self'; report-uri https://your-site.cspradar.com;