proton.me

Score 55/100 · scanned 2026-08-04

Content-Security-Policy

proton.me sends an enforcing CSP. It is allowlist-based.

default-src 'self'; media-src https://static.zdassets.com https://res.cloudinary.com https://pmecdn.protonweb.com; connect-src 'self' wss: https://protonmail.zendesk.com https://ekr.zdassets.com blob: https://account.proton.me https://reports.proton.me https://telemetry.proton.me https://*.algolia.net https://*.algolianet.com https://go.getproton.me https://noembed.com https://boards-api.greenhouse.io https://proton.me https://*.paypal.com https://*.paypalobjects.com https://growth.proton.me ; script-src 'self' blob: 'unsafe-eval' 'unsafe-inline'  https://static.zdassets.com https://pmecdn.protonweb.com https://www.youtube.com https://platform.twitter.com https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://pmecdn.protonweb.com https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://pmecdn.protonweb.com; img-src 'self' data: blob: https:; frame-src 'self' data: blob: https://www.youtube-nocookie.com https://platform.twitter.com https://*.paypal.com https://*.paypalobjects.com; object-src 'self' data: blob:; child-src 'self' data: blob: https://*.paypal.com https://*.paypalobjects.com; report-uri https://reports.proton.me/reports/csp; frame-ancestors 'self' https://*.proton.me;

Directive	Sources
`default-src`	`'self'`
`media-src`	`https://static.zdassets.com https://res.cloudinary.com https://pmecdn.protonweb.com`
`connect-src`	`'self' wss: https://protonmail.zendesk.com https://ekr.zdassets.com blob: https://account.proton.me https://reports.proton.me https://telemetry.proton.me https://.algolia.net https://.algolianet.com https://go.getproton.me https://noembed.com https://boards-api.greenhouse.io https://proton.me https://.paypal.com https://.paypalobjects.com https://growth.proton.me`
`script-src`	`'self' blob: 'unsafe-eval' 'unsafe-inline' https://static.zdassets.com https://pmecdn.protonweb.com https://www.youtube.com https://platform.twitter.com https://.paypal.com https://.paypalobjects.com`
`style-src`	`'self' 'unsafe-inline' https://pmecdn.protonweb.com https://.paypal.com https://.paypalobjects.com`
`font-src`	`'self' https://pmecdn.protonweb.com`
`img-src`	`'self' data: blob: https:`
`frame-src`	`'self' data: blob: https://www.youtube-nocookie.com https://platform.twitter.com https://.paypal.com https://.paypalobjects.com`
`object-src`	`'self' data: blob:`
`child-src`	`'self' data: blob: https://.paypal.com https://.paypalobjects.com`
`report-uri`	`https://reports.proton.me/reports/csp`
`frame-ancestors`	`'self' https://*.proton.me`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000; includeSubDomains; preload`
`x-content-type-options`	`nosniff`
`referrer-policy`	`strict-origin-when-cross-origin`
`x-xss-protection`	`0`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: