nytimes.com

Score 20/100 · scanned 2026-08-04

Content-Security-Policy

nytimes.com sends an enforcing CSP. It is allowlist-based.

upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https: nytresource:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: nytresource:; style-src data: 'unsafe-inline' https: nytresource:; img-src data: https: blob: android-webview-video-poster: nytresource:; font-src data: https: nytresource:; connect-src data: https: wss: blob: nytresource:; media-src data: https: blob: nytresource:; object-src https:; child-src https: data: blob: nytresource:; form-action https: nytimes: nytcooking: nytxwd:; report-uri https://csp.nytimes.com/report;

Directive	Sources
`upgrade-insecure-requests`	`(empty)`
`default-src`	`data: 'unsafe-inline' 'unsafe-eval' https: nytresource:`
`script-src`	`data: 'unsafe-inline' 'unsafe-eval' https: blob: nytresource:`
`style-src`	`data: 'unsafe-inline' https: nytresource:`
`img-src`	`data: https: blob: android-webview-video-poster: nytresource:`
`font-src`	`data: https: nytresource:`
`connect-src`	`data: https: wss: blob: nytresource:`
`media-src`	`data: https: blob: nytresource:`
`object-src`	`https:`
`child-src`	`https: data: blob: nytresource:`
`form-action`	`https: nytimes: nytcooking: nytxwd:`
`report-uri`	`https://csp.nytimes.com/report`

Headers sent

Header	Value
`strict-transport-security`	`max-age=63072000; includeSubDomains; preload`
`x-frame-options`	`DENY`
`x-content-type-options`	`nosniff`
`permissions-policy`	`browsing-topics=()`
`x-xss-protection`	`1; mode=block`
`server`	`envoy`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

script-src allows data: URIs, which lets an attacker inline arbitrary script through a data URL.Remove data: from script-src.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: