D
australia.gov.au
Score 55/100 · scanned 2026-08-04Content-Security-Policy
australia.gov.au sends an enforcing CSP. It is allowlist-based.
default-src 'self' my.gov.au; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.youtube.com s.ytimg.com assets.adobedtm.com dynatrace.humanservices.gov.au; connect-src blob: 'self' adobedc.demdex.net docs.apigw.my.gov.au edge.adobedc.net *.my.gov.au my.gov.au mygov-dls-bff.apps.openshift-prod1-dca1.csda.gov.au mygov-dls-bff.apps.openshift-prod1-dcb1.csda.gov.au swift.csda.gov.au stats.g.doubleclick.net dynatrace.humanservices.gov.au *.dynamsoft.com https://127.0.0.1:* ws://127.0.0.1:* wss://127.0.0.1:* data: cdn.jsdelivr.net w3.org/svg/2000; img-src 'self' data: blob: stats.g.doubleclick.net swift.csda.gov.au; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; object-src 'self' blob: swift.csda.gov.au; frame-src 'self' blob: bluey-webchat.azurewebsites.net my.gov.au *.my.gov.au swift.csda.gov.au www.youtube.com www.youtube-nocookie.com w.soundcloud.com servicesaustralia.vudoo.io
| Directive | Sources |
|---|---|
default-src | 'self' my.gov.au |
script-src | 'self' 'unsafe-inline' 'unsafe-eval' www.youtube.com s.ytimg.com assets.adobedtm.com dynatrace.humanservices.gov.au |
connect-src | blob: 'self' adobedc.demdex.net docs.apigw.my.gov.au edge.adobedc.net *.my.gov.au my.gov.au mygov-dls-bff.apps.openshift-prod1-dca1.csda.gov.au mygov-dls-bff.apps.openshift-prod1-dcb1.csda.gov.au swift.csda.gov.au stats.g.doubleclick.net dynatrace.humanservices.gov.au *.dynamsoft.com https://127.0.0.1:* ws://127.0.0.1:* wss://127.0.0.1:* data: cdn.jsdelivr.net w3.org/svg/2000 |
img-src | 'self' data: blob: stats.g.doubleclick.net swift.csda.gov.au |
style-src | 'self' 'unsafe-inline' fonts.googleapis.com |
font-src | 'self' fonts.gstatic.com |
object-src | 'self' blob: swift.csda.gov.au |
frame-src | 'self' blob: bluey-webchat.azurewebsites.net my.gov.au *.my.gov.au swift.csda.gov.au www.youtube.com www.youtube-nocookie.com w.soundcloud.com servicesaustralia.vudoo.io |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=63072000; includeSubdomains; |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
server | Apache |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: