Browser & Web Performance · Senior · Question 69 of 75

Why should the CSP be sent as an HTTP header rather than a `<meta>` tag when possible?

1<meta> CSP is ignored by all browsers
2Headers are smaller
✓Correct answer: Some directives like frame-ancestors and reporting don't work in <meta>, and the header covers content before the tag is parsed

Explanation

A meta CSP is a fallback for static hosting where you can't control headers.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.