B
netflix.com
Score 80/100 · scanned 2026-08-04Content-Security-Policy
No enforcing Content-Security-Policy on the homepage response. What that means →
Headers sent
| Header | Value |
|---|---|
content-security-policy-report-only | default-src https: wss: 'unsafe-inline' 'unsafe-eval'; font-src https: data: ; img-src https: data: blob: ; media-src https: blob: ; worker-src https: blob: ; report-uri https://www.netflix.com/log/w… |
strict-transport-security | max-age=31536000; includeSubDomains |
x-frame-options | DENY |
x-content-type-options | nosniff |
x-xss-protection | 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport |
server | envoy |
Re-scan live
This is a snapshot from 2026-08-04. Check it now: