F
discover.com
Score 10/100 · scanned 2026-08-04Content-Security-Policy
discover.com sends an enforcing CSP. It is allowlist-based.
default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'
| Directive | Sources |
|---|---|
default-src | https: data: blob: 'unsafe-inline' 'unsafe-eval' |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=31536000 |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
x-xss-protection | 1; mode=block |
server | Apache |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
script-src allows data: URIs, which lets an attacker inline arbitrary script through a data URL.Remove data: from script-src.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: