calendly.com

Score 80/100 · scanned 2026-08-04

Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Header	Value
`content-security-policy-report-only`	`default-src 'self' https:; base-uri 'self'; object-src 'none'; script-src 'self' https: 'report-sample'; style-src 'self' https: 'report-sample'; img-src 'self' data: https:; font-src 'self' data: htt…`
`strict-transport-security`	`max-age=31536000; includeSubDomains; preload`
`x-content-type-options`	`nosniff`
`cross-origin-opener-policy`	`same-origin`
`server`	`cloudflare`

This is a snapshot from 2026-08-04. Check it now: