Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
content-security-policy-report-only	default-src 'self' 'unsafe-inline' *.epfl.ch; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.epfl.ch https://*.cast.switch.ch https://ajax.googleapis.com https://cdnjs.cloudflare.com https://connec…
strict-transport-security	max-age=31536000
x-frame-options	DENY
server	cloudflare

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan