Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
content-security-policy-report-only	style-src 'self' 'unsafe-inline' data: *.ebay.com *.ebay.nl *.ebaystatic.com *.ebaystatic.cn *.gstatic.com *.fontawesome.com blob: *.googleapis.com; connect-src 'self' *.ebay.com *.ebay.nl *.ebaystati…
strict-transport-security	max-age=31536000
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
x-xss-protection	1; mode=block
server	ebay-proxy-server

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan