Overview

default-src defines the fallback policy applied when a more specific fetch directive is not present. Most resource-loading directives — script-src, style-src, img-src, font-src, connect-src and others — inherit this value when omitted. It effectively sets the baseline for the entire policy.

Details

Its value is a list of source expressions: 'self' (the current origin), 'none' (block everything), host sources (https://cdn.example.com), scheme sources (https:, data:, blob:), and — meaningful only for script/style families — 'unsafe-inline', 'unsafe-eval', 'nonce-...', 'sha256-...', and 'strict-dynamic'. Setting default-src 'self' forces all resources to load from the same origin, while any directive you specify explicitly overrides default-src for that resource type.

In practice, teams lay down a safe baseline of default-src 'self' and then open exceptions for specific resource types via individual directives (a whitelist pattern). Crucially, default-src does not cover everything: base-uri, form-action, frame-ancestors, sandbox, and report-uri/report-to do NOT fall back to default-src, so they must be declared separately.

Syntax

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'

Notes

• Starting from default-src 'none' and opening only what you need is the least error-prone approach.
• Even with default-src set, base-uri, form-action, frame-ancestors, sandbox, and report-* are not inherited and require explicit declaration.
• Adding 'unsafe-inline' to default-src permits all inline scripts and styles, defeating XSS protection — avoid it.

Related directives