The policy has no default-src directive.

CSP_NO_DEFAULT_SRC · Severity: Warning

• WarningCSP_NO_DEFAULT_SRC

  The policy has no default-src directive.

  default-src is the fallback for every fetch directive the policy leaves out. Without it, any resource type without its own directive (fonts, frames, workers, media) can load from anywhere.

  Recommendation: Add default-src 'self' (or 'none') and open up only what the site needs.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
• Warning CSP_NO_OBJECT_SRC Plugin content (object and embed elements) is not restricted.
• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.

All findings