Content-Security-Policy

archive.org sends an enforcing CSP. It is nonce-based.

report-uri https://archive.org/services/csp-report; base-uri 'self'; default-src *; img-src * data: blob:; object-src 'none'; media-src * blob:; connect-src * data: blob:; worker-src 'self' blob:; script-src https://archive.org/offshoot_assets/ https://*.archive.org/offshoot_assets/ https://offshoot.prod.archive.org/offshoot_assets/ https://archive.org/includes/ https://*.archive.org/includes/ https://offshoot.prod.archive.org/includes/ https://archive.org/components/ https://*.archive.org/components/ https://offshoot.prod.archive.org/components/ https://archive.org/v/ https://offshoot.prod.archive.org/v/ https://offshoot.prod.archive.org/upload/app/ https://av.archive.org/ https://av.archive.org/js/ https://av.prod.archive.org/js/ https://av.dev.archive.org/ https://esm.archive.org/ https://esm.ext.archive.org/ https://polyfill.archive.org/v3/polyfill.min.js https://offshoot.prod.archive.org/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'sha256-CoX53XgCdkM1zegYEEpMUeYIZnv663inNm8bQv2VRbM=' https://apollo.archive.org/ https://auth.bookshare.org/ https://openlibrary.org/query.json https://emularity-engine.ux-b.archive.org/ https://emularity-config.ux-b.archive.org/ https://emularity-bios.ux-b.archive.org/ https://archive.org/services/emularity/ https://offshoot.prod.archive.org/services/emularity/ 'wasm-unsafe-eval' https://apis.google.com/ https://accounts.google.com/ https://accounts.google.com/gsi/ https://workforcenow.adp.com/ https://synerg.adp.com/ https://*.zdassets.com/ https://*.zendesk.com/; style-src 'unsafe-inline' https://archive.org/ https://*.archive.org/ https://offshoot.prod.archive.org/ https://esm.archive.org/ https://esm.ext.archive.org/ https://offshoot.prod.archive.org/ https://av.archive.org/css/ https://av.dev.archive.org/css/ https://accounts.google.com/gsi/ https://synerg.adp.com/;

Directive	Sources
report-uri	https://archive.org/services/csp-report
base-uri	'self'
default-src	*
img-src	* data: blob:
object-src	'none'
media-src	* blob:
connect-src	* data: blob:
worker-src	'self' blob:
script-src	https://archive.org/offshoot_assets/ https://*.archive.org/offshoot_assets/ https://offshoot.prod.archive.org/offshoot_assets/ https://archive.org/includes/ https://*.archive.org/includes/ https://offshoot.prod.archive.org/includes/ https://archive.org/components/ https://*.archive.org/components/ https://offshoot.prod.archive.org/components/ https://archive.org/v/ https://offshoot.prod.archive.org/v/ https://offshoot.prod.archive.org/upload/app/ https://av.archive.org/ https://av.archive.org/js/ https://av.prod.archive.org/js/ https://av.dev.archive.org/ https://esm.archive.org/ https://esm.ext.archive.org/ https://polyfill.archive.org/v3/polyfill.min.js https://offshoot.prod.archive.org/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'sha256-CoX53XgCdkM1zegYEEpMUeYIZnv663inNm8bQv2VRbM=' https://apollo.archive.org/ https://auth.bookshare.org/ https://openlibrary.org/query.json https://emularity-engine.ux-b.archive.org/ https://emularity-config.ux-b.archive.org/ https://emularity-bios.ux-b.archive.org/ https://archive.org/services/emularity/ https://offshoot.prod.archive.org/services/emularity/ 'wasm-unsafe-eval' https://apis.google.com/ https://accounts.google.com/ https://accounts.google.com/gsi/ https://workforcenow.adp.com/ https://synerg.adp.com/ https://*.zdassets.com/ https://*.zendesk.com/
style-src	'unsafe-inline' https://archive.org/ https://*.archive.org/ https://offshoot.prod.archive.org/ https://esm.archive.org/ https://esm.ext.archive.org/ https://offshoot.prod.archive.org/ https://av.archive.org/css/ https://av.dev.archive.org/css/ https://accounts.google.com/gsi/ https://synerg.adp.com/

Headers sent

Header	Value
strict-transport-security	max-age=15724800
referrer-policy	no-referrer-when-downgrade
server	nginx/1.31.3

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan