files/en-us/web/http/reference/headers/content-security-policy/block-all-mixed-content/index.md
{{deprecated_header}}
[!WARNING] This directive is marked as obsolete in the specification. This directive was previously used to prevent "optionally blockable" mixed content from being fetched insecurely and displayed. Content that isn't blocked is now always upgraded to a secure connection, so this directive is not needed.
The HTTP {{HTTPHeader("Content-Security-Policy")}} (CSP) block-all-mixed-content directive prevents loading any assets over HTTP when the page uses HTTPS.
All mixed content resource requests are blocked, including both blockable and upgradable mixed content. This also applies to {{HTMLElement("iframe")}} documents, ensuring the entire page is mixed content-free.
[!NOTE] The {{CSP("upgrade-insecure-requests")}} directive is evaluated before
block-all-mixed-content. If the former is set, the latter does nothing, so set one directive or the other – not both, unless you want to force HTTPS on older browsers that do not force it after a redirect to HTTP.
Content-Security-Policy: block-all-mixed-content;
Content-Security-Policy: block-all-mixed-content;
<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
To disallow http assets on a more granular level, you can also set individual directives to https:.
For example, to disallow insecure HTTP images:
Content-Security-Policy: img-src https:
Not part of any current specification. Used to be defined in the outdated Mixed Content Level 1 specification.
{{Compat}}