nike.com

Score 35/100 · scanned 2026-08-04

Content-Security-Policy

nike.com sends an enforcing CSP. It is allowlist-based.

frame-ancestors 'self' *.nike.com *.nikecloud.com *.nikedev.com

Directive	Sources
`frame-ancestors`	`'self' .nike.com .nikecloud.com *.nikedev.com`

Headers sent

Header	Value
`strict-transport-security`	`max-age=2628000 ; includeSubDomains`
`x-frame-options`	`sameorigin`
`permissions-policy`	`ch-ua-model=("https://sdk-api-v1.singular.net"), ch-ua-platform-version=("https://sdk-api-v1.singular.net"), ch-ua-full-version-list=("https://sdk-api-v1.singular.net")`
`server`	`unified-edge-router`
`x-powered-by`	`Next.js`

Critical findings

No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: