F
amex.com
Score 5/100 · scanned 2026-08-04Content-Security-Policy
amex.com sends an enforcing CSP. It is allowlist-based.
default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' *;img-src 'self' data: blob: *;font-src 'self' data: *;connect-src 'self' *;media-src 'self' blob: *;frame-ancestors 'self' *.intcx.net *.paragonrels.com *.sigmacomputing.com *.bkfsconnect.com *.bkfstest.com *.opraplan.com *.theice.com *.ice.com *.nyse.com *.kcgbondpoint.com *.icedataservices.com *.appspace.com *.appspaceusercontent.com;frame-src *;worker-src 'self' blob: *;object-src 'self' *;manifest-src 'self' *;form-action 'self' https://*.theice.com https://*.intcx.net https://*.ice.com https://*.nyse.com https://*.kcgbondpoint.com https://*.icedataservices.com https://*.eloqua.com https://*.salesforce.com;upgrade-insecure-requests;base-uri 'self';script-src-attr 'none'
| Directive | Sources |
|---|---|
default-src | 'self' |
script-src | 'self' 'unsafe-inline' 'unsafe-eval' * |
style-src | 'self' 'unsafe-inline' * |
img-src | 'self' data: blob: * |
font-src | 'self' data: * |
connect-src | 'self' * |
media-src | 'self' blob: * |
frame-ancestors | 'self' *.intcx.net *.paragonrels.com *.sigmacomputing.com *.bkfsconnect.com *.bkfstest.com *.opraplan.com *.theice.com *.ice.com *.nyse.com *.kcgbondpoint.com *.icedataservices.com *.appspace.com *.appspaceusercontent.com |
frame-src | * |
worker-src | 'self' blob: * |
object-src | 'self' * |
manifest-src | 'self' * |
form-action | 'self' https://*.theice.com https://*.intcx.net https://*.ice.com https://*.nyse.com https://*.kcgbondpoint.com https://*.icedataservices.com https://*.eloqua.com https://*.salesforce.com |
upgrade-insecure-requests | (empty) |
base-uri | 'self' |
script-src-attr | 'none' |
Headers sent
| Header | Value |
|---|---|
server | cloudflare |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
script-src allows * — any host on the internet may serve executable script.Replace the wildcard with an explicit list, or a nonce with strict-dynamic.
No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Re-scan live
This is a snapshot from 2026-08-04. Check it now: