C
kraken.com
Score 65/100 · scanned 2026-08-04Content-Security-Policy
No enforcing Content-Security-Policy on the homepage response. What that means →
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=31536000; includeSubDomains; preload |
x-frame-options | sameorigin |
x-content-type-options | nosniff |
referrer-policy | strict-origin-when-cross-origin |
permissions-policy | accelerometer=(), autoplay=(self), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self "https://www.youtube-nocookie.com"), geolocation=()… |
x-xss-protection | 1; mode=block |
server | cloudflare |
Critical findings
No Content-Security-Policy. The browser will execute any script that ends up in the page, which is what turns an HTML injection into account takeover.Start with a report-only policy: default-src 'self'; object-src 'none'; base-uri 'self'.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: