Content-Security-Policy

bund.de sends an enforcing CSP. It is nonce-based.

frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests; default-src 'self'; object-src 'none'; connect-src 'self'; img-src 'self' data:; script-src 'self' 'nonce-6672877'; style-src 'self' 'nonce-6672877'; font-src 'self' data:; frame-src 'self' https://www.youtube-nocookie.com;

Directive	Sources
frame-ancestors	'self'
form-action	'self'
upgrade-insecure-requests	(empty)
default-src	'self'
object-src	'none'
connect-src	'self'
img-src	'self' data:
script-src	'self' 'nonce-6672877'
style-src	'self' 'nonce-6672877'
font-src	'self' data:
frame-src	'self' https://www.youtube-nocookie.com

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-frame-options	deny
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
x-xss-protection	0
server	myracloud

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan