Skip to content
Header Hawk

trusted-types

trusted-types lists the policy names a document may pass to trustedTypes.createPolicy(). Anything else throws.

On its own it enforces nothing - a page can still assign strings to innerHTML - but paired with require-trusted-types-for 'script' it is what bounds the problem: every string that becomes markup passes through a named function you chose, and there are only as many of those as you allowed.

Syntax

Section titled “Syntax”
Content-Security-Policy: trusted-types;
Content-Security-Policy: trusted-types 'none';
Content-Security-Policy: trusted-types <policyName> <policyName> 'allow-duplicates';

What it controls

Section titled “What it controls”
  • Which policy names trustedTypes.createPolicy() accepts.
  • Whether a name may be used twice, via 'allow-duplicates'.

Fallback

Section titled “Fallback”

trusted-types has no fallback. Without it, any policy name may be created.

Section titled “Recommended value”
Content-Security-Policy: trusted-types default
  • The policy named default is special: the browser uses it implicitly when a plain string reaches a sink, which makes it the migration lever for code you cannot change. Keep its body small and audited - it is the one function standing between a string and the DOM.
  • Name each library’s policy explicitly once you are past migration. trusted-types dompurify lit-html is a far better security statement than a wildcard.
  • 'allow-duplicates' exists for code that is loaded twice. Reach for it only when you have to; a duplicate name usually means a bundling problem.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

Under trusted-types dompurify:

trustedTypes.createPolicy("dompurify", {
  createHTML: (input) => DOMPurify.sanitize(input),
});

Blocked

Section titled “Blocked”

A name that is not in the list - throws, and reports:

trustedTypes.createPolicy("adhoc", { createHTML: (s) => s });

Browser support

Section titled “Browser support”
  • Baseline 2026: newly available. It works across the latest versions of every major browser as of February 2026.
  • trustedTypes is undefined in a browser without support, so feature-detect before calling createPolicy().

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective trusted-types
effectiveDirective trusted-types
blockedUri trusted-types-policy
Issue title trusted-types policy adhoc
  • blockedUri is the literal string trusted-types-policy, and the sample carries the rejected policy name.
  • There is no host to group on, so issues are grouped by that policy name - one issue per name the page tried to create.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.