The HTTP Content-Security-Policy
(CSP) block-all-mixed-content
directive prevents loading any assets over HTTP when the page uses HTTPS.
All mixed content resource requests are blocked, including both active and passive mixed content. This also applies to <iframe>
documents, ensuring the entire page is mixed content-free.
The upgrade-insecure-requests
directive is evaluated before block-all-mixed-content
. If the former is set, the latter does nothing, so set one directive or the other – not both, unless you want to force HTTPS on older browsers that do not force it after a redirect to HTTP.
Syntax
Content-Security-Policy: block-all-mixed-content;
Examples
Content-Security-Policy: block-all-mixed-content; <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
To disallow http assets on a more granular level, you can also set individual directives to https:
. For example, to disallow nonsecure HTTP images:
Content-Security-Policy: img-src https:
Specifications
Specification | Status | Comment |
---|---|---|
Mixed Content The definition of 'block-all-mixed-content' in that specification. |
Candidate Recommendation | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
block-all-mixed-content | Chrome Full support Yes | Edge Full support ≤79 | Firefox Full support 48 | IE No support No | Opera Full support Yes | Safari ? | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 48 | Opera Android ? | Safari iOS ? | Samsung Internet Android Full support Yes |
Legend
- Full support
- Full support
- No support
- No support
- Compatibility unknown
- Compatibility unknown