newrelic.com

Score 55/100 · scanned 2026-08-04

Content-Security-Policy

newrelic.com sends an enforcing CSP. It is allowlist-based.

frame-ancestors 'self' https://aws.amazon.com *.pathfactory.com *.lookbookhq.com *.newrelic.com https://*.webflow.com https://*.intellimize.co https://117712186.intellimizeio.com

Directive	Sources
`frame-ancestors`	`'self' https://aws.amazon.com .pathfactory.com .lookbookhq.com .newrelic.com https://.webflow.com https://*.intellimize.co https://117712186.intellimizeio.com`

Headers sent

Header	Value
`strict-transport-security`	`max-age=63072000; includeSubDomains; preload`
`x-content-type-options`	`nosniff`

Critical findings

No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: