Content-Security-Policy

haveibeenpwned.com sends an enforcing CSP. It is nonce-based.

script-src 'self' cdnjs.cloudflare.com az416426.vo.msecnd.net ajax.cloudflare.com challenges.cloudflare.com static.cloudflareinsights.com *.monitor.azure.com *.applicationinsights.io 'report-sha256' 'report-sample' 'sha256-cj00wrTvlrj8ekHe2A9FqhDO5X0mvSr/lzIuvFKuMmA=' 'nonce-Og9Z4RQMH2Nef3jZ8sJMutEysv48cgHz0RbjdQxH+4Q='; upgrade-insecure-requests; default-src 'none'; base-uri 'self'; worker-src 'self' blob:; style-src 'self' cdnjs.cloudflare.com api.fontshare.com 'report-sample'; img-src 'self' translate.google.com logos.haveibeenpwned.com haveibeenpwned.com cdnjs.cloudflare.com i.ytimg.com data:; font-src 'self' data: cdnjs.cloudflare.com cdn.fontshare.com fonts.scalar.com; frame-ancestors 'none'; frame-src challenges.cloudflare.com www.youtube.com; form-action 'self' www.paypal.com billing.stripe.com checkout.stripe.com https://stage.haveibeenpwned.com stage.haveibeenpwned.com https://haveibeenpwned.com haveibeenpwned.com billing.haveibeenpwned.com; connect-src 'self' stage.haveibeenpwned.com api.pwnedpasswords.com stage-api.haveibeenpwned.com api.haveibeenpwned.com haveibeenpwned.com dc.services.visualstudio.com *.in.applicationinsights.azure.com *.monitor.azure.com www.google.com translate.googleapis.com cdnjs.cloudflare.com; manifest-src 'self'; report-uri https://heimdall.report-uri.com/r/t/csp/enforce; report-to default

Directive	Sources
script-src	'self' cdnjs.cloudflare.com az416426.vo.msecnd.net ajax.cloudflare.com challenges.cloudflare.com static.cloudflareinsights.com *.monitor.azure.com *.applicationinsights.io 'report-sha256' 'report-sample' 'sha256-cj00wrTvlrj8ekHe2A9FqhDO5X0mvSr/lzIuvFKuMmA=' 'nonce-Og9Z4RQMH2Nef3jZ8sJMutEysv48cgHz0RbjdQxH+4Q='
upgrade-insecure-requests	(empty)
default-src	'none'
base-uri	'self'
worker-src	'self' blob:
style-src	'self' cdnjs.cloudflare.com api.fontshare.com 'report-sample'
img-src	'self' translate.google.com logos.haveibeenpwned.com haveibeenpwned.com cdnjs.cloudflare.com i.ytimg.com data:
font-src	'self' data: cdnjs.cloudflare.com cdn.fontshare.com fonts.scalar.com
frame-ancestors	'none'
frame-src	challenges.cloudflare.com www.youtube.com
form-action	'self' www.paypal.com billing.stripe.com checkout.stripe.com https://stage.haveibeenpwned.com stage.haveibeenpwned.com https://haveibeenpwned.com haveibeenpwned.com billing.haveibeenpwned.com
connect-src	'self' stage.haveibeenpwned.com api.pwnedpasswords.com stage-api.haveibeenpwned.com api.haveibeenpwned.com haveibeenpwned.com dc.services.visualstudio.com *.in.applicationinsights.azure.com *.monitor.azure.com www.google.com translate.googleapis.com cdnjs.cloudflare.com
manifest-src	'self'
report-uri	https://heimdall.report-uri.com/r/t/csp/enforce
report-to	default

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-frame-options	DENY
x-content-type-options	nosniff
referrer-policy	no-referrer-when-downgrade
permissions-policy	accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
server	cloudflare

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan