1password.com

Score 90/100 · scanned 2026-08-04

Content-Security-Policy

1password.com sends an enforcing CSP. It is nonce-based.

default-src 'none'; media-src 'self' https://videos.ctfassets.net:* https://assets.qualified.com https://js.qualified.com; script-src-elem 'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js 'unsafe-hashes' 'sha256-cdFvGnPvdeavqCupE0X1iKxDb2jmBXXTGmE6AcHOk+c=' 'sha256-ep0lyBO1i+WpsX2W3CxFRXjI+Hxg1zdLj+K4nN4Yzdk=' 'sha256-4oZHWXlD1CxPvT8wgkm3WHUpJ/ywMPHPB88gaPqIWak=' 'sha256-013vXU/GPsW1pY4eYpRTI4yOUa7i0F3+gAeV8YiJeI8=' 'sha256-L+uPL9EFQ001JTBerq6Emgr+dGNFjYmEKsAiLjmZ8iU=' 'sha256-TS3QDaf5hBbxZ5c2CUOFJTHeI5BshT2SVba8ez1r6Rc=' 'sha256-wSGTrzhz6pfHVymBKpslj6dh0Yfw6FLQSU1tkScIdak='; script-src 'self' 'wasm-unsafe-eval' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js; style-src 'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='; style-src-elem 'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='; style-src-attr 'unsafe-inline'; connect-src 'self' https://unpkg.com/@rive-app/canvas@2.38.4/rive.wasm https://experience.ninetailed.co https://ingest.insights.ninetailed.co https://assets.ctfassets.net:* https://start.1password.com https://start.1password.ca https://start.1password.eu https://www.google-analytics.com https://us.app.unleash-hosted.com https://flow.1passwordservices.com https://integrations.1passwordservices.com https://telemetry.transcend.io/collect https://browser-intake-datadoghq.com https://sst.1passwordservices.com https://c.6sc.co https://ipv6.6sc.co https://b.6sc.co https://epsilon.6sense.com https://transcend-cdn.com https://1password.zendesk.com https://px.ads.linkedin.com https://px4.ads.linkedin.com https://www.facebook.com https://www.instagram.com https://pixel-config.reddit.com https://*.qualified.com wss://*.qualified.com https://googleads.g.doubleclick.net https://www.google.com; manifest-src 'self'; font-src 'self'; object-src 'self'; img-src 'self' blob: https://images.ctfassets.net:* https://www.google.com https://www.google.ad https://www.google.ae https://www.google.com.af https://www.google.com.ag https://www.google.al https://www.google.am https://www.google.co.ao https://www.google.com.ar https://www.google.as https://www.google.at https://www.google.com.au https://www.google.az https://www.google.ba https://www.google.com.bd https://www.google.be https://www.google.bf https://www.google.bg https://www.google.com.bh https://www.google.bi https://www.google.bj https://www.google.com.bn https://www.google.com.bo https://www.google.com.br https://www.google.bs https://www.google.bt https://www.google.co.bw https://www.google.by https://www.google.com.bz https://www.google.ca https://www.google.cd https://www.google.cf https://www.google.cg https://www.google.ch https://www.google.ci https://www.google.co.ck https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.com.co https://www.google.co.cr https://www.google.com.cu https://www.google.cv https://www.google.com.cy https://www.google.cz https://www.google.de https://www.google.dj https://www.google.dk https://www.google.dm https://www.google.com.do https://www.google.dz https://www.google.com.ec https://www.google.ee https://www.google.com.eg https://www.google.es https://www.google.com.et https://www.google.fi https://www.google.com.fj https://www.google.fm https://www.google.fr https://www.google.ga https://www.google.ge https://www.google.gg https://www.google.com.gh https://www.google.com.gi https://www.google.gl https://www.google.gm https://www.google.gr https://www.google.com.gt https://www.google.gy https://www.google.com.hk https://www.google.hn https://www.google.hr https://www.google.ht https://www.google.hu https://www.google.co.id https://www.google.ie https://www.google.co.il https://www.google.im https://www.google.co.in https://www.google.iq https://www.google.is https://www.google.it https://www.google.je https://www.google.com.jm https://www.google.jo https://www.google.co.jp https://www.google.co.ke https://www.google.com.kh https://www.google.ki https://www.google.kg https://www.google.co.kr https://www.google.com.kw https://www.google.kz https://www.google.la https://www.google.com.lb https://www.google.li https://www.google.lk https://www.google.co.ls https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.com.ly https://www.google.co.ma https://www.google.md https://www.google.me https://www.google.mg https://www.google.mk https://www.google.ml https://www.google.com.mm https://www.google.mn https://www.google.com.mt https://www.google.mu https://www.google.mv https://www.google.mw https://www.google.com.mx https://www.google.com.my https://www.google.co.mz https://www.google.com.na https://www.google.com.ng https://www.google.com.ni https://www.google.ne https://www.google.nl https://www.google.no https://www.google.com.np https://www.google.nr https://www.google.nu https://www.google.co.nz https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.pg https://www.google.com.ph https://www.google.com.pk https://www.google.pl https://www.google.pn https://www.google.com.pr https://www.google.ps https://www.google.pt https://www.google.com.py https://www.google.com.qa https://www.google.ro https://www.google.ru https://www.google.rw https://www.google.com.sa https://www.google.com.sb https://www.google.sc https://www.google.se https://www.google.com.sg https://www.google.sh https://www.google.si https://www.google.sk https://www.google.com.sl https://www.google.sn https://www.google.so https://www.google.sm https://www.google.sr https://www.google.st https://www.google.com.sv https://www.google.td https://www.google.tg https://www.google.co.th https://www.google.com.tj https://www.google.tl https://www.google.tm https://www.google.tn https://www.google.to https://www.google.com.tr https://www.google.tt https://www.google.com.tw https://www.google.co.tz https://www.google.com.ua https://www.google.co.ug https://www.google.co.uk https://www.google.com.uy https://www.google.co.uz https://www.google.com.vc https://www.google.co.ve https://www.google.co.vi https://www.google.com.vn https://www.google.vu https://www.google.ws https://www.google.rs https://www.google.co.za https://www.google.co.zm https://www.google.co.zw https://www.google.cat https://www.google-analytics.com https://sst.1passwordservices.com https://cm.g.doubleclick.net https://stats.g.doubleclick.net https://insight.adsrvr.org https://px.mountain.com https://b.6sc.co https://px.ads.linkedin.com/ https://px4.ads.linkedin.com/ https://www.facebook.com https://www.instagram.com https://alb.reddit.com https://messenger-assets.qualified.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com; child-src https://www.youtube-nocookie.com https://secure.livechatinc.com; frame-src https://www.youtube-nocookie.com https://www.youtube-nocookie.com/embed https://secure.livechatinc.com https://player.vimeo.com https://insight.adsrvr.org https://match.adsrvr.org https://sync-transcend-cdn.com https://www.figma.com https://app.getreprise.com/ https://player.simplecast.com https://integrations.1passwordservices.com; form-action 'self' https://start.1password.com https://flow.1passwordservices.com; frame-ancestors https://*.1passwordservices.com https://*.1password.com https://*.1password.ca https://*.1password.eu https://main.1pstage.com; report-uri https://csp.1passwordservices.com/report?tags=1pw_prd; report-to csp-endpoint

Directive	Sources
`default-src`	`'none'`
`media-src`	`'self' https://videos.ctfassets.net:* https://assets.qualified.com https://js.qualified.com`
`script-src-elem`	'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js 'unsafe-hashes' 'sha256-cdFvGnPvdeavqCupE0X1iKxDb2jmBXXTGmE6AcHOk+c=' 'sha256-ep0lyBO1i+WpsX2W3CxFRXjI+Hxg1zdLj+K4nN4Yzdk=' 'sha256-4oZHWXlD1CxPvT8wgkm3WHUpJ/ywMPHPB88gaPqIWak=' 'sha256-013vXU/GPsW1pY4eYpRTI4yOUa7i0F3+gAeV8YiJeI8=' 'sha256-L+uPL9EFQ001JTBerq6Emgr+dGNFjYmEKsAiLjmZ8iU=' 'sha256-TS3QDaf5hBbxZ5c2CUOFJTHeI5BshT2SVba8ez1r6Rc=' 'sha256-wSGTrzhz6pfHVymBKpslj6dh0Yfw6FLQSU1tkScIdak='
`script-src`	`'self' 'wasm-unsafe-eval' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js`
`style-src`	`'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='`
`style-src-elem`	`'self' 'nonce-1b9c6073-ce14-49a7-ae7e-f229ae6f3d97' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='`
`style-src-attr`	`'unsafe-inline'`
`connect-src`	'self' https://unpkg.com/@rive-app/canvas@2.38.4/rive.wasm https://experience.ninetailed.co https://ingest.insights.ninetailed.co https://assets.ctfassets.net:* https://start.1password.com https://start.1password.ca https://start.1password.eu https://www.google-analytics.com https://us.app.unleash-hosted.com https://flow.1passwordservices.com https://integrations.1passwordservices.com https://telemetry.transcend.io/collect https://browser-intake-datadoghq.com https://sst.1passwordservices.com https://c.6sc.co https://ipv6.6sc.co https://b.6sc.co https://epsilon.6sense.com https://transcend-cdn.com https://1password.zendesk.com https://px.ads.linkedin.com https://px4.ads.linkedin.com https://www.facebook.com https://www.instagram.com https://pixel-config.reddit.com https://.qualified.com wss://.qualified.com https://googleads.g.doubleclick.net https://www.google.com
`manifest-src`	`'self'`
`font-src`	`'self'`
`object-src`	`'self'`
`img-src`	'self' blob: https://images.ctfassets.net:* https://www.google.com https://www.google.ad https://www.google.ae https://www.google.com.af https://www.google.com.ag https://www.google.al https://www.google.am https://www.google.co.ao https://www.google.com.ar https://www.google.as https://www.google.at https://www.google.com.au https://www.google.az https://www.google.ba https://www.google.com.bd https://www.google.be https://www.google.bf https://www.google.bg https://www.google.com.bh https://www.google.bi https://www.google.bj https://www.google.com.bn https://www.google.com.bo https://www.google.com.br https://www.google.bs https://www.google.bt https://www.google.co.bw https://www.google.by https://www.google.com.bz https://www.google.ca https://www.google.cd https://www.google.cf https://www.google.cg https://www.google.ch https://www.google.ci https://www.google.co.ck https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.com.co https://www.google.co.cr https://www.google.com.cu https://www.google.cv https://www.google.com.cy https://www.google.cz https://www.google.de https://www.google.dj https://www.google.dk https://www.google.dm https://www.google.com.do https://www.google.dz https://www.google.com.ec https://www.google.ee https://www.google.com.eg https://www.google.es https://www.google.com.et https://www.google.fi https://www.google.com.fj https://www.google.fm https://www.google.fr https://www.google.ga https://www.google.ge https://www.google.gg https://www.google.com.gh https://www.google.com.gi https://www.google.gl https://www.google.gm https://www.google.gr https://www.google.com.gt https://www.google.gy https://www.google.com.hk https://www.google.hn https://www.google.hr https://www.google.ht https://www.google.hu https://www.google.co.id https://www.google.ie https://www.google.co.il https://www.google.im https://www.google.co.in https://www.google.iq https://www.google.is https://www.google.it https://www.google.je https://www.google.com.jm https://www.google.jo https://www.google.co.jp https://www.google.co.ke https://www.google.com.kh https://www.google.ki https://www.google.kg https://www.google.co.kr https://www.google.com.kw https://www.google.kz https://www.google.la https://www.google.com.lb https://www.google.li https://www.google.lk https://www.google.co.ls https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.com.ly https://www.google.co.ma https://www.google.md https://www.google.me https://www.google.mg https://www.google.mk https://www.google.ml https://www.google.com.mm https://www.google.mn https://www.google.com.mt https://www.google.mu https://www.google.mv https://www.google.mw https://www.google.com.mx https://www.google.com.my https://www.google.co.mz https://www.google.com.na https://www.google.com.ng https://www.google.com.ni https://www.google.ne https://www.google.nl https://www.google.no https://www.google.com.np https://www.google.nr https://www.google.nu https://www.google.co.nz https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.pg https://www.google.com.ph https://www.google.com.pk https://www.google.pl https://www.google.pn https://www.google.com.pr https://www.google.ps https://www.google.pt https://www.google.com.py https://www.google.com.qa https://www.google.ro https://www.google.ru https://www.google.rw https://www.google.com.sa https://www.google.com.sb https://www.google.sc https://www.google.se https://www.google.com.sg https://www.google.sh https://www.google.si https://www.google.sk https://www.google.com.sl https://www.google.sn https://www.google.so https://www.google.sm https://www.google.sr https://www.google.st https://www.google.com.sv https://www.google.td https://www.google.tg https://www.google.co.th https://www.google.com.tj https://www.google.tl https://www.google.tm https://www.google.tn https://www.google.to https://www.google.com.tr https://www.google.tt https://www.google.com.tw https://www.google.co.tz https://www.google.com.ua https://www.google.co.ug https://www.google.co.uk https://www.google.com.uy https://www.google.co.uz https://www.google.com.vc https://www.google.co.ve https://www.google.co.vi https://www.google.com.vn https://www.google.vu https://www.google.ws https://www.google.rs https://www.google.co.za https://www.google.co.zm https://www.google.co.zw https://www.google.cat https://www.google-analytics.com https://sst.1passwordservices.com https://cm.g.doubleclick.net https://stats.g.doubleclick.net https://insight.adsrvr.org https://px.mountain.com https://b.6sc.co https://px.ads.linkedin.com/ https://px4.ads.linkedin.com/ https://www.facebook.com https://www.instagram.com https://alb.reddit.com https://messenger-assets.qualified.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com
`child-src`	`https://www.youtube-nocookie.com https://secure.livechatinc.com`
`frame-src`	`https://www.youtube-nocookie.com https://www.youtube-nocookie.com/embed https://secure.livechatinc.com https://player.vimeo.com https://insight.adsrvr.org https://match.adsrvr.org https://sync-transcend-cdn.com https://www.figma.com https://app.getreprise.com/ https://player.simplecast.com https://integrations.1passwordservices.com`
`form-action`	`'self' https://start.1password.com https://flow.1passwordservices.com`
`frame-ancestors`	`https://.1passwordservices.com https://.1password.com https://.1password.ca https://.1password.eu https://main.1pstage.com`
`report-uri`	`https://csp.1passwordservices.com/report?tags=1pw_prd`
`report-to`	`csp-endpoint`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000; includeSubdomains; preload`
`x-content-type-options`	`nosniff`
`referrer-policy`	`no-referrer-when-downgrade`
`server`	`cloudflare`
`x-powered-by`	`Next.js`

Re-scan live

This is a snapshot from 2026-08-04. Check it now: