D
cam.ac.uk
Score 45/100 · scanned 2026-08-04Content-Security-Policy
cam.ac.uk sends an enforcing CSP. It is allowlist-based.
report-uri /report-csp-violation; upgrade-insecure-requests
| Directive | Sources |
|---|---|
report-uri | /report-csp-violation |
upgrade-insecure-requests | (empty) |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=2592000, max-age=31622400; includeSubDomains; preload |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
referrer-policy | strict-origin-when-cross-origin |
permissions-policy | autoplay=*, camera=self, fullscreen=*, geolocation=*, microphone=self, picture-in-picture=*, web-share=self |
server | nginx |
Critical findings
No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: