digitalocean.com

Score 45/100 · scanned 2026-08-04

Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
`content-security-policy-report-only`	`default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://segment.digitalocean.com https://consent.trustarc.com https://*.trustarc.com https://fast.wistia.com http…`
`x-frame-options`	`SAMEORIGIN`
`x-xss-protection`	`1; mode=block`
`server`	`cloudflare`
`x-powered-by`	`Next.js`

Critical findings

No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains

Re-scan live

This is a snapshot from 2026-08-04. Check it now: