Skip to main content

​
Content Security Policy Reference

Every game deployed on Greenhouse Games has a Content Security Policy (CSP) injected into its HTML. This policy controls what resources your game can load and where it can make network requests.

​
Full CSP Policy

The following policy is applied to your game during deployment:

​
How It’s Injected

During deployment, the platform injects a <meta> tag as the first meta tag inside the <head> element of every HTML file (.html and .htm) in your game bundle. The injected tag looks like this:
This means every HTML file in your bundle — not just index.html — will have the CSP enforced.

​
Directive Breakdown

​
Key Takeaways

  • All assets must be bundled locally. You cannot load scripts, images, fonts, or stylesheets from external CDNs or third-party servers.
  • Inline scripts and styles are permitted. You don’t need to externalize all code into separate files.
  • Blob URLs are supported for scripts, workers, images, frames, and network connections — useful for dynamically generated content.
  • External network requests are blocked. fetch(), XMLHttpRequest, and WebSocket connections can only reach same-origin endpoints.
  • No external font or image CDNs. Google Fonts, Font Awesome CDN, and similar services won’t work — include the font files in your bundle instead.