child-srcchild-src is an umbrella directive that controls the sources of both nested browsing contexts (iframes) and workers (Web/Shared Workers). Today it mainly serves as a fallback for frame-src (frames) and worker-src (workers). When omitted it inherits from default-src.
In CSP2, child-src was introduced to replace frame-src, but CSP3 re-split frames and workers into frame-src and worker-src because their needs differ. As a result, child-src now remains the shared fallback when those two are unspecified. The fallback order is: (frames) frame-src → child-src → default-src, and (workers) worker-src → child-src → default-src.
In practice, specifying frame-src and worker-src separately is recommended for clarity. If you care about older-browser compatibility, you may keep child-src alongside them as a safety net.
Content-Security-Policy: child-src 'self' https://www.youtube.com