Content-Security-Policy

natwest.com sends an enforcing CSP. It is allowlist-based.

upgrade-insecure-requests;

Directive	Sources
upgrade-insecure-requests	(empty)

Headers sent

Header	Value
content-security-policy-report-only	default-src 'self' blob: data: 'unsafe-inline' 'unsafe-eval' *.adobedtm.com *.scene7.com *.amazon-adsystem.com *.appdemostore.com *.atdmt.com *.avocet.io *.blubrry.com *.clicktale.net *.craftyclicks.c…
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
permissions-policy	geolocation=(self "https://natwest.com")
x-xss-protection	1; mode=block
access-control-allow-origin	https://supportcentre.natwest.com

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan