Skip to content
Header Hawk

plugin-types

plugin-types restricted which MIME types <object> and <embed> could instantiate. Its purpose was to let a site permit, say, PDF while refusing Flash.

Browser plugins are gone, and with them the reason for the directive. The replacement is not a narrower plugin-types - it is object-src 'none', which refuses the elements themselves.

Syntax

Section titled “Syntax”
Content-Security-Policy: plugin-types application/pdf;

What it controls

Section titled “What it controls”
  • Which MIME types <object> and <embed> could load - historically, and only in Chromium and WebKit.

Fallback

Section titled “Fallback”

plugin-types had no fallback, and no browser consults it today.

Section titled “Recommended value”
Content-Security-Policy: object-src 'none'
  • It is strictly stronger: it refuses the elements outright rather than filtering what they may instantiate, and it is supported everywhere.
  • Delete plugin-types when you next touch the policy. Leaving it in suggests to the next reader that it is doing something.

Examples

Section titled “Examples”

Blocked

Section titled “Blocked”

What the modern equivalent refuses:

<embed src="/legacy/player.swf" type="application/x-shockwave-flash" />

Browser support

Section titled “Browser support”
  • Removed from Chrome in version 90 (April 2021). Implemented in Chromium and WebKit only; never in Firefox.
  • Ignored as an unknown directive by every current browser.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
  • No current browser implements the directive, so nothing can violate it.
  • HeaderHawk does not recognise the name either. A report from some archaeological browser would be filed under default-src.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.