> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ghg.gg/llms.txt
> Use this file to discover all available pages before exploring further.
# CSP Policy Reference
> The full Content Security Policy enforced on all deployed games
# Content Security Policy Reference
Every game deployed on Greenhouse Games has a Content Security Policy (CSP) injected into its HTML. This policy controls what resources your game can load and where it can make network requests.
## Full CSP Policy
The following policy is applied to your game during deployment:
```
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; connect-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-src 'self' blob:; worker-src 'self' blob:
```
## How It's Injected
During deployment, the platform injects a `` tag as the **first meta tag** inside the `` element of every HTML file (`.html` and `.htm`) in your game bundle. The injected tag looks like this:
```html theme={null}
```
This means every HTML file in your bundle — not just `index.html` — will have the CSP enforced.
## Directive Breakdown
| Directive | Value | What It Means |
| ------------- | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `default-src` | `'self'` | By default, only resources from the same origin are allowed |
| `script-src` | `'self' 'unsafe-inline' 'unsafe-eval' blob:` | Scripts can be loaded from same origin, inline scripts are allowed, `eval()` is permitted, and blob URLs can be used |
| `connect-src` | `'self' blob:` | Network requests (fetch, XHR, WebSocket) are limited to same-origin and blob URLs |
| `style-src` | `'self' 'unsafe-inline'` | Stylesheets from same origin and inline styles are allowed |
| `img-src` | `'self' data: blob:` | Images can be loaded from same origin, data URIs, and blob URLs |
| `font-src` | `'self'` | Fonts must be loaded from the same origin |
| `frame-src` | `'self' blob:` | Iframes can load same-origin content and blob URLs |
| `worker-src` | `'self' blob:` | Web Workers must be loaded from same-origin or blob URLs |
## Key Takeaways
* **All assets must be bundled locally.** You cannot load scripts, images, fonts, or stylesheets from external CDNs or third-party servers.
* **Inline scripts and styles are permitted.** You don't need to externalize all code into separate files.
* **Blob URLs are supported** for scripts, workers, images, frames, and network connections — useful for dynamically generated content.
* **External network requests are blocked.** `fetch()`, `XMLHttpRequest`, and WebSocket connections can only reach same-origin endpoints.
* **No external font or image CDNs.** Google Fonts, Font Awesome CDN, and similar services won't work — include the font files in your bundle instead.