D
datadoghq.com
Score 45/100 · scanned 2026-08-04Content-Security-Policy
datadoghq.com sends an enforcing CSP. It is allowlist-based.
frame-ancestors 'self' https://onlinexperiences.com https://next.brella.io https://pheedloop.com https://gather.town https://datadog.docebosaas.com/
| Directive | Sources |
|---|---|
frame-ancestors | 'self' https://onlinexperiences.com https://next.brella.io https://pheedloop.com https://gather.town https://datadog.docebosaas.com/ |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=63072000; includeSubDomains; preload |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
referrer-policy | no-referrer-when-downgrade |
x-xss-protection | 1; mode=block |
server | AmazonS3 |
Critical findings
No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: