Headers: CSP.block-all-mixed-content
Content-Security-Policy: block-all-mixed-content directive
Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.
Warning: This directive is marked as obsolete in the specification. This directive was previously used to prevent "optionally blockable" mixed content from being fetched insecurely and displayed. Content that isn't blocked is now always upgraded to a secure connection, so this directive is not needed.
The HTTP Content-Security-Policy (CSP) block-all-mixed-content directive prevents loading any assets over HTTP when the page uses HTTPS.
All mixed content resource requests are blocked, including both blockable and upgradable mixed content. This also applies to <iframe> documents, ensuring the entire page is mixed content-free.
Note: The upgrade-insecure-requests directive is evaluated before block-all-mixed-content. If the former is set, the latter does nothing, so set one directive or the other – not both, unless you want to force HTTPS on older browsers that do not force it after a redirect to HTTP.
Syntax
Content-Security-Policy: block-all-mixed-content;
Examples
Content-Security-Policy: block-all-mixed-content; <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
To disallow http assets on a more granular level, you can also set individual directives to https:. For example, to disallow insecure HTTP images:
Content-Security-Policy: img-src https:
Specifications
| Specification |
|---|
| Mixed Content> # strict-checking> |
Browser compatibility
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Opera | Safari | Chrome Android | Firefox for Android | Opera Android | Safari on IOS | Samsung Internet | WebView Android | WebView on iOS | |
block-all-mixed-content |
44Will be removed, see bug 40260100. |
79Will be removed, see bug 40260100. |
48–122 | 31Will be removed, see bug 40260100. |
10 | 44Will be removed, see bug 40260100. |
48–122 | 32Will be removed, see bug 40260100. |
10 | 4.0Will be removed, see bug 40260100. |
44Will be removed, see bug 40260100. |
10 |
See also
© 2005–2025 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
