harvard.edu

Score 30/100 · scanned 2026-08-04

Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
`server`	`nginx`

Critical findings

No Content-Security-Policy. The browser will execute any script that ends up in the page, which is what turns an HTML injection into account takeover.Start with a report-only policy: default-src 'self'; object-src 'none'; base-uri 'self'.

No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains

Re-scan live

This is a snapshot from 2026-08-04. Check it now: