Content-Security-Policy

gov.uk sends an enforcing CSP. It is nonce-based.

default-src 'self'; base-uri 'none'; script-src 'self' www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com www.gstatic.com *.ytimg.com www.youtube.com www.youtube-nocookie.com 'nonce-ESCMha4KqcQDtg+Kh0ap2w=='; style-src 'self' www.gstatic.com; font-src 'self'; object-src 'none'; frame-src 'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.youtube.com www.youtube-nocookie.com; frame-ancestors 'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk; report-uri https://csp-reporter.publishing.service.gov.uk/report; img-src 'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com lux.speedcurve.com assets.digital.cabinet-office.gov.uk https://img.youtube.com https://i.ytimg.com https://api.os.uk data: https://tiles.openfreemap.org data:; connect-src 'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com lux.speedcurve.com https://tiles.openfreemap.org data:

Directive	Sources
default-src	'self'
base-uri	'none'
script-src	'self' www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com www.gstatic.com *.ytimg.com www.youtube.com www.youtube-nocookie.com 'nonce-ESCMha4KqcQDtg+Kh0ap2w=='
style-src	'self' www.gstatic.com
font-src	'self'
object-src	'none'
frame-src	'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.youtube.com www.youtube-nocookie.com
frame-ancestors	'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk
report-uri	https://csp-reporter.publishing.service.gov.uk/report
img-src	'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com lux.speedcurve.com assets.digital.cabinet-office.gov.uk https://img.youtube.com https://i.ytimg.com https://api.os.uk data: https://tiles.openfreemap.org data:
connect-src	'self' *.publishing.service.gov.uk www.gov.uk *.dev.gov.uk www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net www.googletagmanager.com www.region1.google-analytics.com region1.google-analytics.com www.google.co.uk analytics.google.com *.analytics.google.com www.google.com lux.speedcurve.com https://tiles.openfreemap.org data:

Headers sent

Header	Value
strict-transport-security	max-age=31536000; preload
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
permissions-policy	interest-cohort=()
x-xss-protection	0
server	nginx

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan