Skip to content
Header Hawk

style-src-elem

style-src-elem covers stylesheets and <style> blocks. Paired with a permissive style-src-attr, it is how a site keeps real control of its CSS while tolerating a framework that writes style attributes.

Syntax

Section titled “Syntax”
Content-Security-Policy: style-src-elem 'none';
Content-Security-Policy: style-src-elem <source-expression-list>;

What it controls

Section titled “What it controls”
  • <style> elements.
  • <link rel="stylesheet"> elements.
  • Stylesheets delivered by the Link: HTTP header.
  • @import rules inside a stylesheet.

What it does not control

Section titled “What it does not control”
  • style attributes on elements - see style-src-attr.

Fallback

Section titled “Fallback”

If style-src-elem is absent, the browser consults style-src, and then default-src. The full chain is style-src-elem → style-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: style-src-elem 'self'
  • Set it when you need elements and attributes to differ. If they do not, style-src says the same thing in one directive.
  • Because it only became baseline recently, keep an equivalent style-src in the policy: a browser that does not know style-src-elem falls back to it, and one that does ignores it for elements.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

A same-origin stylesheet:

<link rel="stylesheet" href="/assets/app.css" />

Blocked

Section titled “Blocked”

Under style-src-elem 'self', a hosted font stylesheet:

<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter" />

Browser support

Section titled “Browser support”
  • Baseline 2025: newly available. It works across the latest versions of every major browser as of December 2025, and not in older ones - noticeably later than style-src-attr, which has been widely available since December 2022.
  • 'unsafe-hashes' does not apply to this directive.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective style-src-elem
effectiveDirective style-src-elem
blockedUri https://fonts.googleapis.com/css2, inline
Issue title style-src-elem blocking fonts.googleapis.com
  • Reports naming style-src-elem arrive from policies that only set style-src. Do not read the directive name in a report as evidence of what your header says - read originalPolicy on the report detail for that.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.