HTML Guide

Bad value “”Content-Security-Policy”” for attribute “http-equiv” on element “meta”.

The W3C HTML Validator issue you’re encountering indicates that the value specified for the http-equiv attribute in a <meta> tag is not valid. This often happens due to incorrect formatting, spelling errors, or extraneous characters in the attribute value.

To resolve this issue, ensure that the http-equiv attribute is spelled correctly and that it contains valid values. For a basic Content Security Policy (CSP), the correct way to specify it in the <meta> tag is as follows:

Correct Usage of `<meta>` with `http-equiv`

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta http-equiv="Content-Security-Policy" content="default-src 'self';">
    <title>Document Example</title>
</head>
<body>
    <h1>Hello, World!</h1>
</body>
</html>

Fixes to Apply:

Ensure Correct Spelling: The attribute value must be spelled exactly as “Content-Security-Policy” (case-sensitive).
Check for Extraneous Characters: Make sure there are no extra quotes or spaces within the attribute value.

Example of a Bad Value:

If your original <meta> tag looks something like this:

<meta http-equiv=""Content-Security-Policy"" content="default-src 'self';">

You should change it to:

<meta http-equiv="Content-Security-Policy" content="default-src 'self';">

Learn more:

MDN: content-security-police

Related W3C validator issues

A document must not include both a “meta” element with an “http-equiv” attribute whose value is “content-type”, and a “meta” element with a “charset” attribute.

In order to define the charset encoding of an HTML document, both of these options are valid, but only one of them must appear in the document:

<!-- This is the preferred way -->
<meta charset="UTF-8">

<!-- This is the older way, also valid -->
<meta http-equiv="content-type" content="text/html; charset=UTF-8">

A “meta” element with an “http-equiv” attribute whose value is “X-UA-Compatible” must have a “content” attribute with the value “IE=edge”.

The only value admitted for the attribute content in a <meta http-equiv="X-UA-Compatible"> is currently IE=edge. You’re probably seeing this issue because the page being validated includes the following meta tag:

<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />

As the Google Chrome Frame plugin was discontinued on February 25, 2014, this is longer supported so you should change that meta tag to:

<meta http-equiv="X-UA-Compatible" content="IE=edge" />

According to this article in Wikipedia:

Google Chrome Frame was a plug-in designed for Internet Explorer based on the open-source Chromium project, first announced on September 22, 2009. It went stable in September 2010, on the first birthday of the project. It was discontinued on February 25, 2014 and is no longer supported.

The plug-in worked with Internet Explorer 6, 7, 8 and 9. It allowed suitably coded web pages to be displayed in Internet Explorer by Google Chrome’s versions of the WebKit layout engine and V8 JavaScript engine.

Attribute “http-equiv” not allowed on element “meta” at this point.

A <meta> element using the http-equiv attribute has been found in an unexpected place of the document. It should appear inside the <head> section, like in this example:

<!DOCTYPE html>
<html lang="">
  <head>
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    <title>Test</title>
  </head>
  <body>
    <p>Content of the page</p>
  </body>
</html>

The http-equiv attribute is used in web pages to simulate an HTTP response header. While HTTP response headers can be set from the server, not everyone has access to the server configuration, so an alternative is using <meta http-equiv> to define settings that would otherwise require setting an HTTP response header.

The most popular use of http-equiv are defining the content-type of the document as in the example above, although in HTML5 it’s preferred to use this instead:

<meta charset="UTF-8">

Another popular use of the http-equiv is setting an automatic reload of the web page, for example this will have the browser reload the page every 60 seconds:

<meta http-equiv="refresh" content="60">

However, refreshing a page automatically is a bad practice regarding accessibility, as users do not expect a page to do that, and doing so will move focus back to the top of the page, which may create a frustrating or confusing experience.

Other values that can be used with the http-equiv attribute include:

content-security-policy
content-length.
content-encoding
default-style
window-target

Bad value “cleartype” for attribute “http-equiv” on element “meta”.

Bad value “Content-Script-Type” for attribute “http-equiv” on element “meta”.

Bad value “Content-Style-Type” for attribute “http-equiv” on element “meta”.

Element “meta” is missing one or more of the following attributes: “charset”, “content”, “http-equiv”, “itemprop”, “name”, “property”.

There’s an incomplete or incorrectly formed <meta> tag. The <meta> tag in HTML is used to provide metadata about the HTML document. This metadata is typically specified using attributes like charset, content, http-equiv, itemprop, name, and property.

To fix this issue, you need to ensure that your <meta> tags include at least one of these attributes. Here are some examples of properly formed <meta> tags with each of these attributes:

Using the charset attribute:
```
<meta charset="UTF-8">
```
This specifies the character encoding for the HTML document, which is crucial for displaying text correctly in different languages.
Using the content and name attributes:
```
<meta name="description" content="A brief description of the webpage content.">
```
This provides a description of the webpage content, which can be used by search engines.
Using the http-equiv and content attributes:
```
<meta http-equiv="refresh" content="30">
```
This specifies information to be passed to the browser, such as refreshing the page every 30 seconds.
Using the property and content attributes:
```
<meta property="og:title" content="Your Webpage Title">
```
This is used for Open Graph meta tags, which improve the appearance of shared content on social media platforms.

Correct Usage Example

Here’s an example of an HTML document with a properly formed set of <meta> tags:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="description" content="A brief description of the webpage content.">
    <meta http-equiv="refresh" content="30">
    <meta property="og:title" content="Your Webpage Title">
    <title>Document</title>
</head>
<body>
    <!-- Page content goes here -->
</body>
</html>

A “charset” attribute on a “meta” element found after the first 1024 bytes.

charset
meta

The <meta charset> is expected to appear at the beginning of the document, within the first 1024 bytes. Consider moving it to the beginning of the <head> section, as in this example:

<head>
  <meta charset="utf-8">
  ...
</head>

A character encoding declaration is a mechanism by which the character encoding used to store or transmit a document is specified. For HTML documents, the standard way to declare a document character encoding is by including a <meta> tag with a charset attribute, typically <meta charset="utf-8">.

According to the W3C standard:

The element containing the character encoding declaration must be serialized completely within the first 1024 bytes of the document.

A document must not include more than one “meta” element with a “charset” attribute.

meta
charset

Attribute “charset” not allowed on element “meta” at this point.

meta
charset

A <meta> tag has been found that is either malformed, or in a bad place within the document. Check its attributes and context.

For example, the following HTML contains a valid <meta> tag that is raising an issue because of bad context, caused by an <img> tag that shouldn’t be there:

<!DOCTYPE html>
<html lang="">
  <head>
    <title>Test</title>
    <img src="photo.jpg" alt="A smiling cat" />
    <meta charset="utf-8" />
  </head>
  <body>
    <p>Some content</p>
  </body>
</html>

If we fix that document and move the <img> tag within the body, the issue raised about <meta> disappears because it’s now in a valid context:

<!DOCTYPE html>
<html lang="">
  <head>
    <title>Test</title>
    <meta charset="utf-8" />
  </head>
  <body>
    <p>Some content</p>
    <img src="photo.jpg" alt="A smiling cat" />
  </body>
</html>