Content Security Policy (CSP)Baseline · Widely available

Content Security Policy (CSP) helps to mitigate certain security threats, including cross-site scripting (XSS) and clickjacking attacks. It consists of a set of directives from a website to a browser, which instruct the browser to restrict the things that the site is allowed to do.

Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Aug 2, 2016. Widely available since Feb 2, 2019.

How to use ↓Compare browsers

Browser support

DesktopChrome

1–24Not supported

25+Supportedsince Feb 21, 2013

Current: 155

Edge

12–13Not supported

14+Supportedsince Aug 2, 2016

Current: 154

Firefox

1–22Not supported

23+Supportedsince Aug 6, 2013

Current: 157

Safari

1–6Not supported

7+Supportedsince Oct 22, 2013

Current: 27

MobileChrome Android

18–18Not supported

25+Supportedsince Feb 27, 2013

Current: 155

Firefox Android

4–22Not supported

23+Supportedsince Aug 6, 2013

Current: 157

Safari iOS

1–6Not supported

7+Supportedsince Sep 18, 2013

Current: 27

How to use

This feature is Baseline widely available — use it freely, no fallback needed.

Example

Full syntax and examples are on MDN: securitypolicyviolation event.

Feature detection

JS · check before using

if ("HTMLIFrameElement" in globalThis && "csp" in HTMLIFrameElement.prototype) {
  // HTMLIFrameElement.csp is available
}

Documentation (MDN)

Specification

w3c.github.io/webappsec-csp ↗

Usage share

Sub-features

Support for each part of the feature (52). The overall table above shows when the whole feature works.

Sub-feature	Chrome	Edge	Firefox	Safari	Chrome Android	Firefox Android	Safari iOS
Document.securitypolicyviolation_event	76	79	93	15.4	76	93	15.4
Element.securitypolicyviolation_event	41	15	63	10	41	63	10
HTMLElement.nonce	61	79	75	15.4	61	79	15.4
HTMLIFrameElement.csp	61	79	✕	✕	61	✕	✕
SecurityPolicyViolationEvent	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.SecurityPolicyViolationEvent	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.blockedURI	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.columnNumber	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.disposition	56	79	63	15	56	63	15
SecurityPolicyViolationEvent.documentURI	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.effectiveDirective	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.lineNumber	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.originalPolicy	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.referrer	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.sample	59	79	63	15	59	63	15
SecurityPolicyViolationEvent.sourceFile	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.statusCode	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.violatedDirective	41	15	63	10	41	63	10
SecurityPolicyViolationEvent.worker_support	56	15	63	✕	56	63	✕
WorkerGlobalScope.securitypolicyviolation_event	41	15	63	10	41	63	10

Show 32 more

Sub-feature	Chrome	Edge	Firefox	Safari	Chrome Android	Firefox Android	Safari iOS
iframe.csp	61	79	✕	✕	61	✕	✕
meta.http-equiv.content-security-policy	≤59	12	1	≤10.1	≤59	4	≤10.3
nonce	61	79	75	15.5	61	79	15.5
http.headers.Content-Security-Policy	25	14	23	7	25	23	7
http.headers.Content-Security-Policy-Report-Only	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.base-uri	40	79	35	10	40	35	9.3
http.headers.Content-Security-Policy.child-src	40	15	45	10	40	45	9.3
http.headers.Content-Security-Policy.connect-src	25	14	50	7	25	23	7
http.headers.Content-Security-Policy.default-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.font-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.form-action	40	15	36	10	40	36	9.3
http.headers.Content-Security-Policy.frame-ancestors	40	15	58	10	40	58	9.3
http.headers.Content-Security-Policy.frame-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.img-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.manifest-src	40	79	41	11	40	41	11
http.headers.Content-Security-Policy.media-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.meta-element-support	25	≤18	45	7	25	45	7
http.headers.Content-Security-Policy.object-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.report-sample	59	79	63	15.4	59	63	15.4
http.headers.Content-Security-Policy.sandbox	25	14	50	7	25	50	7
http.headers.Content-Security-Policy.script-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.script-src-attr	75	79	108	15.4	75	108	15.4
http.headers.Content-Security-Policy.script-src-elem	75	79	108	15.4	75	108	15.4
http.headers.Content-Security-Policy.script-src.external_scripts	59	79	116	15.6	59	116	15.6
http.headers.Content-Security-Policy.script-src.wasm-unsafe-eval	97	97	102	16	97	102	16
http.headers.Content-Security-Policy.strict-dynamic	52	79	52	15.4	52	52	15.4
http.headers.Content-Security-Policy.style-src	25	14	23	7	25	23	7
http.headers.Content-Security-Policy.style-src-attr	75	79	108	15.4	75	108	15.4
http.headers.Content-Security-Policy.style-src-elem	75	79	108	26.2	75	108	26.2
http.headers.Content-Security-Policy.unsafe-hashes	69	79	109	15.4	69	109	15.4
http.headers.Content-Security-Policy.worker-src	59	79	58	15.5	59	58	15.5
http.headers.Content-Security-Policy.worker_support	56	79	50	10	56	50	10