Options for the generated HTML files.
Inject a <base> element into the page <head>. A string sets href; an object sets both href and optionally target. Skipped if the HTML already contains a <base> element.
stringValue for the href attribute of the <base> element.
stringValue for the target attribute of the <base> element (e.g. "_blank").
Inject a <meta http-equiv="Content-Security-Policy"> into every webpack-emitted HTML page. false (default) does nothing; true uses a strict baseline (script-src 'self', style-src 'self', object-src 'none', base-uri 'self') and appends a sha256 hash of every inline <script>/<style> to script-src/style-src. An object customizes it. Skipped when the page already declares a CSP.
"sha256" | "sha384" | "sha512"Hash algorithm used for inline <script>/<style> sources.
stringPlaceholder nonce added to injected <script>/<style> tags and as a 'nonce-…' source; rewrite it per request server-side.
CSP directives merged over the baseline. Each key is a directive (e.g. "script-src"); the value is a source string or list. Inline hashes and any nonce are still appended to script-src/style-src.
string | boolean | { [index: string]: string | { color?: string; crossorigin?: "use-credentials" | "anonymous"; href: string; media?: string; sizes?: string; type?: string } | HtmlFaviconIcon[] } | ((name: string) => string | boolean | { [index: string]: string | HtmlFaviconIcon[] | { color?: string; crossorigin?: "use-credentials" | "anonymous"; href: string; media?: string; sizes?: string; type?: string } })Favicon(s) for webpack-generated HTML (authored pages are left untouched). false (default) injects nothing; true injects the webpack logo; a string is a path to an icon; an object maps each <link rel> to an icon — a path string, an object with the icon href plus extra link attributes (sizes, media, color, type, crossorigin), or an array of these for multiple icons under the same rel (e.g. several sizes, or light/dark media variants); a function receives the page name and returns one of these. Every icon is emitted as a hashed asset.
false | "body" | "head"Where to place injected chunk <script>/<link> tags. "body" (default; "head" with output.module) keeps them next to the entry tag — end of <body> on generated pages; "head" moves them into <head>; false suppresses sibling-chunk injection (entry tags and resource hints remain).
Inline the content of matching chunks directly into the HTML instead of emitting a separate <script>/<link> tag. true inlines every chunk; "script" inlines only JavaScript, "style" only CSS; an array of RegExp patterns matches against the chunk name.
Add Subresource Integrity (SRI) integrity attributes to injected <script>/<link> tags. true uses ['sha384']; an array sets the hash algorithms; a function receives each referenced asset and returns the algorithms to use or false to skip it.
Web app manifest for webpack-generated HTML (authored pages are left untouched). false (default) injects nothing. A string is a path to an existing .webmanifest file to link. An object is the manifest contents — serialized, emitted as a hashed .webmanifest and linked with <link rel="manifest">; its icons/screenshots src paths resolve like any request and are emitted as hashed assets. A function receives the page name and returns one of these.
Inject <meta> tags into the page <head>. Each key is the name attribute (or "charset" for a charset declaration); the value is the content string. Keys beginning with og: use the property attribute instead of name. A tag is skipped if the HTML already contains a meta with the same name.
"defer" | "auto" | "blocking"How injected <script> tags load. auto (default) emits a module script for ES module output and defer otherwise; defer forces a deferred script; blocking emits a plain blocking script.
stringSets the <title> of the generated HTML page. Skipped if the HTML already contains a <title> element.