Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
content-security-policy-report-only	default-src *.cisa.gov; script-src *.cisa.gov 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com cse.google.com cdn.jsdelivr.net www.google.com www.youtube.com dap.digitalgov.gov cdnjs.cloudflare.…
strict-transport-security	max-age=31536000 ; includeSubDomains
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan