Safety
CSP img-src vs Mixed Content for Public Sites
December 25, 2022
CSP img-src vs mixed content for public sites is two different image problems. Mixed content is an HTTPS page that still loads http:// images, scripts, or styles — browsers may block or padlock-warn. img-src in Content-Security-Policy lists which origins may be used as images, including data: and blob:. A tight img-src does not fix http:// on the same host. upgrade-insecure-requests can rewrite http:// to https:// for some fetches; it is not an allowlist. RoastMyOpsec's mixed-content check parses the landing HTML for http:// script, style, and image URLs. It does not score missing img-src as a standalone F, does not load every img, and does not exploit image sinks.
The practical difference
Scheme is mixed content. Host is img-src. A page can be all-HTTPS and still allow img-src * — any origin's picture, including a tracking pixel. style-src and script-src do not cover <img>. frame-src covers iframes, not images.
OG images and CDNs belong on named HTTPS hosts. data: URLs in img-src are a product choice; they are not a reason to set *.
How to choose img-src
Brochure with a first-party CDN: img-src 'self' https://images.example.com (or your real host). Third-party avatars: name that host, not https:. Tracking pixels: prefer first-party analytics instead of a third-party img. Mixed content: fix the URLs or use upgrade-insecure-requests, then keep img-src tight. Report-Only first if a CMS injects surprise image hosts.
| Control | What it limits | Does not replace | Takeaway |
|---|---|---|---|
| HTTPS + no http:// assets | Mixed content | img-src | See mixed content vs HTTPS |
| img-src allowlist | Which hosts may be images | Mixed-content scheme | Name CDNs, not * |
| upgrade-insecure-requests | http:// → https:// rewrite | A host allowlist | See UIR vs HSTS |
| style-src | CSS | img-src | See style-src vs unsafe-inline |
When img-src wins
img-src wins when the page is already HTTPS and a CMS still loads images from anywhere. Mixed-content fixes win first if the HTML still has http://. Neither is SRI — images rarely use integrity hashes the way scripts do.
What the roast can prove
http:// image, script, and style URLs in landing HTML can surface. Missing img-src is not scored as its own finding. Confirm the CSP header yourself. Pair with third-party trackers if the 'image' is a pixel.
Common mistakes
The first mistake is img-src * because one product photo host kept moving.
The second mistake is treating mixed-content off as proof img-src is tight.
The third mistake is img-src https: which allows any HTTPS origin.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does mixed-content protection replace img-src?
- No. Mixed content is the URL scheme. img-src is which hosts may load as images.
- Should brochure sites set img-src?
- Yes if you have CSP at all: 'self' plus named image CDNs. Missing it is not a roast F by itself.
- Does RoastMyOpsec score img-src?
- It parses http:// assets in HTML and grades CSP quality overall. It does not treat img-src as the only CSP check.