Safety
CSP default-src vs Named Directives for Public Sites
November 12, 2022
CSP default-src vs named directives for public sites is a fallback versus an explicit fetch type. default-src sets the allowlist for fetch types you did not name — scripts, images, fonts, connect, and more, with documented exceptions (frame-ancestors, sandbox, report-uri, and a few others never fall back to default-src). script-src, img-src, connect-src, and the rest override that fallback for that type. A tight default-src 'self' with script-src 'unsafe-inline' is still an inline-script miss. RoastMyOpsec grades CSP quality overall. It does not treat missing default-src as the only CSP check, does not execute every allowed host, and does not exploit XSS.
The practical difference
Named directives win when you need a different allowlist per type — CDN images, first-party scripts, one API host. default-src wins as the floor so you do not forget font-src and leak to *. frame-ancestors is not covered by default-src; set it on purpose. See CSP vs X-Frame-Options.
default-src * is not a policy. It is a shrug.
How to choose a policy shape
Brochure with first-party assets: default-src 'self'; plus named img-src/font-src for CDNs you actually use; script-src with nonces or hashes, not unsafe-inline. Report-Only first. Do not copy a 40-directive generator dump you cannot explain. Pair with CSP report-only vs enforcing until the violation bucket is quiet.
| Directive | What it covers | Falls back to default-src? | Takeaway |
|---|---|---|---|
| default-src | Unnamed fetch types | It is the fallback | Set a tight floor |
| script-src | Scripts | Yes, if omitted | See nonces vs hashes |
| img-src | Images | Yes, if omitted | See img-src vs mixed content |
| frame-ancestors | Who may embed you | No | Set it explicitly |
When named directives still win
They win whenever one type must be looser than the floor — a font CDN, an image CDN, a single API. default-src still wins as the catch-all. Missing default-src with every fetch type named is valid but easy to forget a new type. Pair with manifest-src if you ship a PWA JSON from another host.
What the roast can prove
CSP quality signals on the landing header can surface. Missing default-src is not the only check. Confirm which types actually fall back. Pair with Report-Only until enforcing will not break the CMS.
Common mistakes
The first mistake is default-src * because one widget kept moving hosts.
The second mistake is assuming frame-ancestors inherits from default-src.
The third mistake is a tight default-src and unsafe-inline on script-src forever.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does default-src cover clickjacking?
- No. frame-ancestors does not fall back to default-src. Set framing headers on purpose.
- Should brochure sites set default-src?
- Yes if you have CSP at all: a tight floor plus named CDNs. Missing it is not the only roast CSP check.
- Does RoastMyOpsec score default-src alone?
- No. It grades CSP quality overall. It does not treat default-src as the only directive that matters.