Content-Security-Policy

hubspot.com sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

script-src 'unsafe-inline' 'unsafe-eval' 'self' 1003891.track.convertexperiments.com app.hubspot.com cdn-3.convertexperiments.com cdn-4.convertexperiments.com *.metrics.convertexperiments.com *.signals.convertexperiments.com logs.convertexperiments.com *.convertexperiments.com cdn.pdst.fm connect.facebook.net js.hs-analytics.net js.hs-banner.com js.hsforms.net js.hsleadflows.net js.hubspotfeedback.com js.usemessages.com organizer.bizzabo.com play.vidyard.com script.hotjar.com snap.licdn.com static.hotjar.com static.hsappstatic.net www.google-analytics.com www.googletagmanager.com www.recaptcha.net code.highcharts.com www.youtube.com js.hubspot.com www.dropbox.com widget.altrulabs.com www.google.com maps.googleapis.com wt-assets.hubteam.com cdn2.hubspot.net www.redditstatic.com cdn.veritonic.com gosniply.com d.impactradius-event.com js.hubspot.com 50339659.hs-sites.com analytics.tiktok.com api.s10h.io 'strict-dynamic' 'nonce-6dX43kOE5Jav+sKPscsx1A=='; report-uri https://send.hsbrowserreports.com/csp/report; upgrade-insecure-requests

Directive	Sources
script-src	'unsafe-inline' 'unsafe-eval' 'self' 1003891.track.convertexperiments.com app.hubspot.com cdn-3.convertexperiments.com cdn-4.convertexperiments.com *.metrics.convertexperiments.com *.signals.convertexperiments.com logs.convertexperiments.com *.convertexperiments.com cdn.pdst.fm connect.facebook.net js.hs-analytics.net js.hs-banner.com js.hsforms.net js.hsleadflows.net js.hubspotfeedback.com js.usemessages.com organizer.bizzabo.com play.vidyard.com script.hotjar.com snap.licdn.com static.hotjar.com static.hsappstatic.net www.google-analytics.com www.googletagmanager.com www.recaptcha.net code.highcharts.com www.youtube.com js.hubspot.com www.dropbox.com widget.altrulabs.com www.google.com maps.googleapis.com wt-assets.hubteam.com cdn2.hubspot.net www.redditstatic.com cdn.veritonic.com gosniply.com d.impactradius-event.com js.hubspot.com 50339659.hs-sites.com analytics.tiktok.com api.s10h.io 'strict-dynamic' 'nonce-6dX43kOE5Jav+sKPscsx1A=='
report-uri	https://send.hsbrowserreports.com/csp/report
upgrade-insecure-requests	(empty)

Headers sent

Header	Value
content-security-policy-report-only	script-src 'self' 'unsafe-inline' 'unsafe-eval' 50339659.hs-sites.com 1003891.track.convertexperiments.com app.hubspot.com cdn-3.convertexperiments.com cdn-4.convertexperiments.com *.metrics.convertex…
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-frame-options	DENY
x-content-type-options	nosniff
referrer-policy	no-referrer-when-downgrade
x-xss-protection	1
server	cloudflare

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan