script-src overview

script-src controls which sources a browser may load and execute JavaScript from. It is set through the Content-Security-Policy response header and is the core directive for stopping cross-site scripting (XSS): once it is present, an injected <script> tag or inline event handler will not run unless you have explicitly allowed it.

Where it goes

script-src is one directive inside the Content-Security-Policy header. Send the header on the HTML response:

Content-Security-Policy: script-src 'self' https://cdn.example.com

That policy allows scripts served from the page's own origin and from https://cdn.example.com, and blocks everything else, including all inline scripts.

A source list is space-separated

The value after script-src is a list of source expressions separated by spaces. A script is allowed if it matches at least one entry:

Content-Security-Policy: script-src 'self' https://cdn.example.com 'nonce-r4nd0m'

The full set of values you can use is on the source list reference.

Fallback to default-src

If you do not set script-src, the browser falls back to default-src for script requests. These two policies behave identically for scripts:

Content-Security-Policy: default-src 'self'
Content-Security-Policy: default-src 'none'; script-src 'self'

Setting script-src explicitly overrides default-src for scripts only. Other resource types keep using default-src. Because of this fallback, a common strict baseline is default-src 'none' plus an explicit script-src, so every resource type is denied unless you opt it in.

script-src is itself a fallback

In CSP Level 3, script-src is the fallback for two narrower directives:

• script-src-elem covers <script> elements.
• script-src-attr covers inline event handler attributes such as onclick.

If you do not set those, both use script-src. Most sites only need script-src.

Next steps

• Allow specific inline scripts with a nonce or a hash.
• Manage large third-party script trees with strict-dynamic.
• Read the console errors a blocked script produces.