The policy uses a directive that has been removed from CSP.

CSP_DEPRECATED_DIRECTIVE · Severity: Info

• InfoCSP_DEPRECATED_DIRECTIVE

  The policy uses a directive that has been removed from CSP.

  Directives such as block-all-mixed-content, plugin-types, prefetch-src, navigate-to and referrer were dropped from the standard; current browsers ignore them or will stop supporting them.

  Recommendation: Remove the directive named in the evidence, or use its replacement.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
• Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.
• Warning CSP_NO_OBJECT_SRC Plugin content (object and embed elements) is not restricted.

All findings