F
box.com
Score 0/100 · scanned 2026-08-04Content-Security-Policy
box.com sends an enforcing CSP. It is allowlist-based.
default-src * 'self' blob: data: 'unsafe-inline'; font-src 'self' data: fonts.googleapis.com fonts.gstatic.com
| Directive | Sources |
|---|---|
default-src | * 'self' blob: data: 'unsafe-inline' |
font-src | 'self' data: fonts.googleapis.com fonts.gstatic.com |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=2592000; includeSubDomains; preload |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
x-xss-protection | 1; mode=block |
server | cloudflare |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
script-src allows * — any host on the internet may serve executable script.Replace the wildcard with an explicit list, or a nonce with strict-dynamic.
script-src allows data: URIs, which lets an attacker inline arbitrary script through a data URL.Remove data: from script-src.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: