nist.gov

Score 35/100 · scanned 2026-08-04

Content-Security-Policy

nist.gov sends an enforcing CSP. It is allowlist-based.

default-src 'self'; script-src 'self' *.nist.gov js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net gov-bam.nr-data.net 'unsafe-inline' 'unsafe-eval' www.google-analytics.com *.googletagmanager.com platform.twitter.com https://player.vimeo.com static.cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' *.nist.gov fonts.googleapis.com  *.typekit.net; img-src 'self' 'unsafe-inline' data: *.nist.gov *.google-analytics.com *.googletagmanager.com cdnsecakmi.kaltura.com nist-el-nfrlhrr.s3.amazonaws.com https://cdn.jsdelivr.net/npm/leaflet-fullscreen@1.0.2/dist/fullscreen@2x.png https://cdn.jsdelivr.net/npm/leaflet-fullscreen@1.0.2/dist/fullscreen.png api.mapbox.com syndication.twitter.com https://h5p.org https://i.vimeocdn.com; media-src 'self' nist-el-nfrlhrr.s3.amazonaws.com; frame-src 'self' tube.nist.gov sts.nist.gov sts2.nist.gov *.kaltura.com *.youtube.com *.arcgis.com https://platform.twitter.com/ https://player.vimeo.com https://vimeo.com/ https://time.gov/ login.nist.gov https://customer-ltx6ylk10sje63q6.cloudflarestream.com https://challenges.cloudflare.com; frame-ancestors 'self'; child-src 'self' blob: tube.nist.gov sts.nist.gov sts2.nist.gov *.kaltura.com *.youtube.com *.arcgis.com *.time.gov login.nist.gov; font-src 'self' *.nist.gov fonts.googleapis.com fonts.gstatic.com *.typekit.net data:; connect-src 'self' bam.nr-data.net bam-cell.nr-data.net gov-bam.nr-data.net *.google-analytics.com *.analytics.google.com *.googletagmanager.com; upgrade-insecure-requests

Directive	Sources
`default-src`	`'self'`
`script-src`	`'self' .nist.gov js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net gov-bam.nr-data.net 'unsafe-inline' 'unsafe-eval' www.google-analytics.com .googletagmanager.com platform.twitter.com https://player.vimeo.com static.cloudflareinsights.com https://challenges.cloudflare.com`
`style-src`	`'self' 'unsafe-inline' .nist.gov fonts.googleapis.com .typekit.net`
`img-src`	`'self' 'unsafe-inline' data: .nist.gov .google-analytics.com *.googletagmanager.com cdnsecakmi.kaltura.com nist-el-nfrlhrr.s3.amazonaws.com https://cdn.jsdelivr.net/npm/leaflet-fullscreen@1.0.2/dist/fullscreen@2x.png https://cdn.jsdelivr.net/npm/leaflet-fullscreen@1.0.2/dist/fullscreen.png api.mapbox.com syndication.twitter.com https://h5p.org https://i.vimeocdn.com`
`media-src`	`'self' nist-el-nfrlhrr.s3.amazonaws.com`
`frame-src`	`'self' tube.nist.gov sts.nist.gov sts2.nist.gov .kaltura.com .youtube.com *.arcgis.com https://platform.twitter.com/ https://player.vimeo.com https://vimeo.com/ https://time.gov/ login.nist.gov https://customer-ltx6ylk10sje63q6.cloudflarestream.com https://challenges.cloudflare.com`
`frame-ancestors`	`'self'`
`child-src`	`'self' blob: tube.nist.gov sts.nist.gov sts2.nist.gov .kaltura.com .youtube.com .arcgis.com .time.gov login.nist.gov`
`font-src`	`'self' .nist.gov fonts.googleapis.com fonts.gstatic.com .typekit.net data:`
`connect-src`	`'self' bam.nr-data.net bam-cell.nr-data.net gov-bam.nr-data.net .google-analytics.com .analytics.google.com *.googletagmanager.com`
`upgrade-insecure-requests`	`(empty)`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000`
`x-frame-options`	`SAMEORIGIN, SAMEORIGIN`
`x-content-type-options`	`nosniff`
`x-xss-protection`	`1;mode=block`
`server`	`cloudflare`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: