Safety
CSP frame-src vs object-src for Embeds on Public Sites
December 16, 2022
CSP frame-src vs object-src for embeds on public sites is two fetch allowlists that people mix up. frame-src lists URLs that may load in nested browsing contexts — typically <iframe>. object-src lists URLs for <object>, <embed>, and <applet>. YouTube, Vimeo, and most marketing embeds are iframes, so object-src 'none' does not block them. frame-ancestors is the opposite direction: who may put your page in an iframe. child-src is the older combined directive; prefer the split. RoastMyOpsec reads CSP quality on the landing HTML. It does not score missing frame-src as a standalone F, does not load third-party embeds, and does not exploit iframes.
The practical difference
If the tag is iframe, think frame-src (and sandbox on the tag). If the tag is object or embed for a plugin or PDF, think object-src. script-src is still JavaScript on the parent page. Sandbox flags on the iframe are a third control — see iframe sandbox vs frame-ancestors.
A default-src of * with no frame-src still allows any iframe host. Name the hosts you actually embed, or use 'none' on brochure pages that have no embeds.
How to choose a policy
Brochure with no embeds: frame-src 'none' and object-src 'none'. One YouTube video: frame-src https://www.youtube.com https://www.youtube-nocookie.com (or your consented host list), still object-src 'none'. PDF in <embed>: prefer a first-party viewer or a download link; if you must, object-src 'self'. Report-Only first if a tag manager injects surprise iframes.
| Directive | Typical tags | Does not replace | Takeaway |
|---|---|---|---|
| frame-src | <iframe> nested documents | frame-ancestors | Allowlist video hosts, not * |
| object-src 'none' | <object> <embed> plugins | frame-src | Day-one default |
| frame-ancestors | Who may iframe you | frame-src | See CSP vs XFO |
| iframe sandbox | That element's privileges | CSP fetch lists | Per-embed lock |
When frame-src wins
frame-src wins when object-src is already 'none' and a CMS still injects third-party iframes. object-src still wins as the plugin default. Neither is postMessage origin checks — see postMessage vs CORS.
What the roast can prove
CSP presence and quality signals on the HTML response can surface. Missing frame-src is not scored as its own finding. Confirm the directive in the header. Pair with third-party trackers if the 'embed' is a pixel iframe.
Common mistakes
The first mistake is object-src 'none' and assuming YouTube is blocked.
The second mistake is frame-src https: because one partner kept changing CDNs.
The third mistake is treating frame-src as frame-ancestors.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does object-src 'none' break YouTube iframes?
- No. Iframes are frame-src. object-src is plugins and embed/object tags.
- Should brochure sites set frame-src 'none'?
- Yes if they do not embed anything. Missing it is not a roast F by itself if default-src is already tight.
- Does RoastMyOpsec score frame-src?
- It grades CSP quality overall. It does not load embeds or treat frame-src as the only CSP check.