Safety
CSP child-src vs worker-src for Public Sites
October 26, 2022
CSP child-src vs worker-src for public sites is an old combined directive versus the split that replaced it. child-src used to cover nested browsing contexts (frames) and workers. Today, frame-src lists which hosts may be framed and worker-src lists Worker, SharedWorker, and Service Worker scripts. script-src can still fall back for workers if worker-src and child-src are absent. child-src is not gone from every browser, but new policies should name frame-src and worker-src instead of hoping one leftover covers both. RoastMyOpsec grades CSP quality overall. It does not score missing child-src as a standalone F, does not execute workers, and does not load child frames as an attack.
The practical difference
Frames are frame-src (and frame-ancestors for who may embed you). Workers are worker-src. child-src is the older umbrella. object-src is plugins, not workers. sandbox is flags, not hosts.
A generator that still emits only child-src is cargo-cult, not a modern split.
How to choose directives
New brochure CSP: frame-src for embeds you include, worker-src 'self' or 'none' if you have no workers, script-src for page JS. Do not add child-src to a new header. Migrating an old policy: copy child-src into frame-src and worker-src, then drop child-src when reports are quiet. Report-Only first.
| Directive | What it covers | Status | Takeaway |
|---|---|---|---|
| frame-src | Nested frames you include | Current | See frame-src vs object-src |
| worker-src | Worker scripts | Current | See worker-src vs script-src |
| child-src | Frames and workers (old) | Legacy combined | Do not ship on new sites |
| script-src | Page JS; worker fallback | Current | Not a frame allowlist |
When child-src still appears
It appears in old CSP copies and some CMS plugins. worker-src plus frame-src still win. Missing child-src is healthy. Pair with iframe sandbox if the child also needs flags.
What the roast can prove
CSP quality signals can surface. Missing child-src is not a finding. Confirm frame-src and worker-src yourself. Pair with service worker vs Cache-Control if a worker caches HTML.
Common mistakes
The first mistake is adding child-src because a 2016 cheat sheet still lists it.
The second mistake is child-src 'self' and assuming YouTube iframes are blocked.
The third mistake is omitting worker-src and assuming script-src 'none' cannot spawn a worker later.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should new sites set child-src?
- No. Set frame-src and worker-src. Missing child-src is not a roast F.
- Does child-src replace frame-ancestors?
- No. child-src and frame-src are hosts you may frame. frame-ancestors is who may frame you.
- Does RoastMyOpsec score child-src?
- No. It grades CSP quality overall and does not treat child-src as the only worker or frame check.