HeaderAudit
D

cam.ac.uk

Score 45/100 · scanned 2026-08-04

Content-Security-Policy

cam.ac.uk sends an enforcing CSP. It is allowlist-based.

report-uri /report-csp-violation; upgrade-insecure-requests
DirectiveSources
report-uri/report-csp-violation
upgrade-insecure-requests(empty)

Headers sent

HeaderValue
strict-transport-securitymax-age=2592000, max-age=31622400; includeSubDomains; preload
x-frame-optionsSAMEORIGIN
x-content-type-optionsnosniff
referrer-policystrict-origin-when-cross-origin
permissions-policyautoplay=*, camera=self, fullscreen=*, geolocation=*, microphone=self, picture-in-picture=*, web-share=self
servernginx

Critical findings

No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: