Content-Security-Policy

linkedin.com sends an enforcing CSP. It is allowlist-based.

require-trusted-types-for 'script';report-uri /recaptcha/challengepage/_/RecaptchaChallengePageUi/cspreport, script-src 'report-sample' 'nonce-d-qYSMZtGuemwWBCTmGu2g' 'unsafe-inline';object-src 'none';base-uri www.google.com;report-uri /recaptcha/challengepage/_/RecaptchaChallengePageUi/cspreport;worker-src 'self'

Directive	Sources
require-trusted-types-for	'script'
report-uri	/recaptcha/challengepage/_/RecaptchaChallengePageUi/cspreport
object-src	'none'
base-uri	www.google.com
worker-src	'self'

Headers sent

Header	Value
strict-transport-security	max-age=31536000
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
permissions-policy	ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy	same-origin
cross-origin-resource-policy	same-site
x-xss-protection	0
server	ESF
access-control-allow-origin	*

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan