Content-Security-Policy

ikea.com sends an enforcing CSP. It is allowlist-based.

child-src 'self' *.vimeo.com *.vimeocdn.com; connect-src 'self' www.ikea.com cdn.cookielaw.org *.onetrust.com *.sentry.io browser.sentry-cdn.com www.googletagmanager.com analytics.google.com *.google-analytics.com *.analytics.google.com *.vimeo.com *.vimeocdn.com https://vimeo.com https://player.vimeo.com https://web-api.ikea.com api.dexf.ikea.com https://customer-kc4xhkbjgbi4usng.cloudflarestream.com; default-src 'none'; font-src 'self' data: www.ikea.com; frame-ancestors 'self' www.ikea.com https://vimeo.com *.vimeo.com *.vimeocdn.com; frame-src 'self' www.ikea.com https://vimeo.com *.vimeo.com *.vimeocdn.com https://cdnapisec.kaltura.com https://cfvod.kaltura.com https://customer-kc4xhkbjgbi4usng.cloudflarestream.com; img-src 'self' data: www.ikea.com *.cookielaw.org *.vimeocdn.com i.ytimg.com www.googletagmanager.com analytics.google.com *.google-analytics.com *.analytics.google.com cfvod.kaltura.com inter.ikea.net; media-src 'self' blob: www.ikea.com https://*.vimeocdn.com; object-src 'none'; report-uri https://o514642.ingest.us.sentry.io/api/4507106698199040/security/?sentry_key=b241887609d049f2792a57b6d5941f18&sentry_environment=global; script-src 'report-sample' 'self' www.ikea.com cdn.cookielaw.org www.googletagmanager.com www.google-analytics.com browser.sentry-cdn.com https://*.vimeocdn.com *.vimeo.com https://player.vimeo.com api.vimeo.com www.google-analytics.com *.cloudflareinsights.com; script-src-attr 'self' 'report-sample' 'unsafe-hashes' 'sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I='; style-src 'report-sample' 'self' 'unsafe-inline' *.vimeocdn.com cdn.cookielaw.org; worker-src 'self' blob:

Directive	Sources
child-src	'self' *.vimeo.com *.vimeocdn.com
connect-src	'self' www.ikea.com cdn.cookielaw.org *.onetrust.com *.sentry.io browser.sentry-cdn.com www.googletagmanager.com analytics.google.com *.google-analytics.com *.analytics.google.com *.vimeo.com *.vimeocdn.com https://vimeo.com https://player.vimeo.com https://web-api.ikea.com api.dexf.ikea.com https://customer-kc4xhkbjgbi4usng.cloudflarestream.com
default-src	'none'
font-src	'self' data: www.ikea.com
frame-ancestors	'self' www.ikea.com https://vimeo.com *.vimeo.com *.vimeocdn.com
frame-src	'self' www.ikea.com https://vimeo.com *.vimeo.com *.vimeocdn.com https://cdnapisec.kaltura.com https://cfvod.kaltura.com https://customer-kc4xhkbjgbi4usng.cloudflarestream.com
img-src	'self' data: www.ikea.com *.cookielaw.org *.vimeocdn.com i.ytimg.com www.googletagmanager.com analytics.google.com *.google-analytics.com *.analytics.google.com cfvod.kaltura.com inter.ikea.net
media-src	'self' blob: www.ikea.com https://*.vimeocdn.com
object-src	'none'
report-uri	https://o514642.ingest.us.sentry.io/api/4507106698199040/security/?sentry_key=b241887609d049f2792a57b6d5941f18&sentry_environment=global
script-src	'report-sample' 'self' www.ikea.com cdn.cookielaw.org www.googletagmanager.com www.google-analytics.com browser.sentry-cdn.com https://*.vimeocdn.com *.vimeo.com https://player.vimeo.com api.vimeo.com www.google-analytics.com *.cloudflareinsights.com
script-src-attr	'self' 'report-sample' 'unsafe-hashes' 'sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I='
style-src	'report-sample' 'self' 'unsafe-inline' *.vimeocdn.com cdn.cookielaw.org
worker-src	'self' blob:

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains
server	cloudflare

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan