HeaderAudit
C

kraken.com

Score 65/100 · scanned 2026-08-04

Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

HeaderValue
strict-transport-securitymax-age=31536000; includeSubDomains; preload
x-frame-optionssameorigin
x-content-type-optionsnosniff
referrer-policystrict-origin-when-cross-origin
permissions-policyaccelerometer=(), autoplay=(self), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self "https://www.youtube-nocookie.com"), geolocation=()…
x-xss-protection1; mode=block
servercloudflare

Critical findings

No Content-Security-Policy. The browser will execute any script that ends up in the page, which is what turns an HTML injection into account takeover.Start with a report-only policy: default-src 'self'; object-src 'none'; base-uri 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: