F
cnn.com
Score 0/100 · scanned 2026-08-04Content-Security-Policy
cnn.com sends an enforcing CSP. It is allowlist-based.
default-src 'self' blob: https://*.cnn.com:* http://*.cnn.com:* *.cnn.io:* *.cnn.net:* *.turner.com:* *.turner.io:* *.ugdturner.com:* courageousstudio.com *.vgtf.net:*; script-src 'unsafe-eval' 'unsafe-inline' 'self' *; style-src 'unsafe-inline' 'self' blob: *; child-src 'self' blob: *; frame-src 'self' *; object-src 'self' *; img-src 'self' data: blob: *; media-src 'self' data: blob: *; font-src 'self' data: *; connect-src 'self' data: *; frame-ancestors 'self' https://*.cnn.com:* http://*.cnn.com https://*.cnn.io:* http://*.cnn.io:* *.turner.com:* courageousstudio.com;
| Directive | Sources |
|---|---|
default-src | 'self' blob: https://*.cnn.com:* http://*.cnn.com:* *.cnn.io:* *.cnn.net:* *.turner.com:* *.turner.io:* *.ugdturner.com:* courageousstudio.com *.vgtf.net:* |
script-src | 'unsafe-eval' 'unsafe-inline' 'self' * |
style-src | 'unsafe-inline' 'self' blob: * |
child-src | 'self' blob: * |
frame-src | 'self' * |
object-src | 'self' * |
img-src | 'self' data: blob: * |
media-src | 'self' data: blob: * |
font-src | 'self' data: * |
connect-src | 'self' data: * |
frame-ancestors | 'self' https://*.cnn.com:* http://*.cnn.com https://*.cnn.io:* http://*.cnn.io:* *.turner.com:* courageousstudio.com |
Headers sent
| Header | Value |
|---|---|
x-content-type-options | nosniff |
x-xss-protection | 1; mode=block |
access-control-allow-origin | * |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
script-src allows * — any host on the internet may serve executable script.Replace the wildcard with an explicit list, or a nonce with strict-dynamic.
No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Re-scan live
This is a snapshot from 2026-08-04. Check it now: