mozilla.org

Score 55/100 · scanned 2026-08-04

Content-Security-Policy

mozilla.org sends an enforcing CSP. It is allowlist-based.

default-src 'self' *.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; frame-src 'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com; connect-src 'self' *.analytics.google.com *.google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/; style-src 'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org; img-src 'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org; frame-ancestors 'none'; font-src 'self' www.mozilla.org; upgrade-insecure-requests; media-src 'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org; base-uri 'none'

Directive	Sources
`default-src`	`'self' *.mozilla.org`
`form-action`	`'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org`
`frame-src`	`'self' accounts.firefox.com gtm.mozilla.org js.stripe.com www.google-analytics.com www.googletagmanager.com www.youtube.com`
`object-src`	`'none'`
`script-src`	`'self' 'unsafe-eval' 'unsafe-inline' .google-analytics.com .googletagmanager.com cdn.transcend.io google-analytics.com googletagmanager.com js.stripe.com s.ytimg.com tagmanager.google.com transcend-cdn.com www.mozilla.org www.youtube.com`
`connect-src`	`'self' .analytics.google.com .google-analytics.com *.googletagmanager.com analytics.google.com cdn.transcend.io google-analytics.com googletagmanager.com gtm.mozilla.org https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org o1069899.ingest.sentry.io o1069899.sentry.io region1.google-analytics.com telemetry.transcend.io telemetry.us.transcend.io transcend-cdn.com www.mozilla.org/submit/bedrock/`
`style-src`	`'self' 'unsafe-inline' cdn.transcend.io transcend-cdn.com www.mozilla.org`
`img-src`	`'self' blog.mozilla.org data: images.ctfassets.net www.google-analytics.com www.googletagmanager.com www.mozilla.org`
`frame-ancestors`	`'none'`
`font-src`	`'self' www.mozilla.org`
`upgrade-insecure-requests`	`(empty)`
`media-src`	`'self' assets.mozilla.net videos.cdn.mozilla.net www.mozilla.org`
`base-uri`	`'none'`

Headers sent

Header	Value
`content-security-policy-report-only`	`default-src 'self' *.mozilla.org; form-action 'self' https://abdri3ttkb.execute-api.us-east-2.amazonaws.com https://accounts.firefox.com/ https://basket.mozilla.org; frame-src 'self' accounts.firefox.…`
`strict-transport-security`	`max-age=31536000`
`x-frame-options`	`DENY`
`x-content-type-options`	`nosniff`
`referrer-policy`	`strict-origin-when-cross-origin`
`cross-origin-opener-policy`	`same-origin`
`server`	`granian`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: