F
arxiv.org
Score 20/100 · scanned 2026-08-04Content-Security-Policy
arxiv.org sends an enforcing CSP. It is allowlist-based.
frame-ancestors 'none'
| Directive | Sources |
|---|---|
frame-ancestors | 'none' |
Headers sent
| Header | Value |
|---|---|
x-frame-options | SAMEORIGIN |
server | Google Frontend |
Critical findings
No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.
No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Re-scan live
This is a snapshot from 2026-08-04. Check it now: