D
eff.org
Score 55/100 · scanned 2026-08-04Content-Security-Policy
No enforcing Content-Security-Policy on the homepage response. What that means →
Headers sent
| Header | Value |
|---|---|
content-security-policy-report-only | default-src https: 'unsafe-inline' 'unsafe-eval' 'self' data:; img-src 'self' *.eff.org data:; report-uri https://sentry.eff.org/api/2/security/?sentry_key=f1118ad37b5e4afbabe3487ca42fe73e |
x-frame-options | SAMEORIGIN, SAMEORIGIN |
x-content-type-options | nosniff, nosniff |
x-xss-protection | 1; mode=block |
server | nginx |
Critical findings
No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Re-scan live
This is a snapshot from 2026-08-04. Check it now: