r via <code>https://images.example.com</code>, so the following would be <a href="/examples/blocked-csp/">blocked by CSP</a>:</p>
<pre>
&lt;img src="https://other.example.com/photo.jpg"&gt;
</pre>

<h2>What does 'img-src' was not explicitly set mean?</h2>
<p>If you do not set the <code>img-src</code> CSP directive, but you do have the <a href="/default-src/"><code>default-src</code></a> CSP directive set, then that policy will be applied. You need to either make sure that your <code>img</code> <code>src</co