Restricts the base URL used to resolve relative URLs on the page.
Restricts the endpoints that the document may connect to via fetch, XHR, WebSocket, EventSource, and similar APIs.
Fallback for all fetch destinations that are not explicitly covered by a more specific directive.
Restricts the origins from which fonts may be loaded.
Restricts the URLs that can be used as form submission targets.
Restricts which origins may embed this document in frames, iframes, or objects.
Restricts the origins from which images, icons, and similar media-like assets may be loaded.
Restricts the origins from which audio and video media may be loaded.
Restricts the sources from which plugins such as
Restricts valid sources for JavaScript.
Restricts inline script event handlers and similar script attributes.
Restricts valid sources for stylesheets and inline style usage.
Definition of CSP options.