Content-Security-Policy

reddit.com sends an enforcing CSP. It is nonce-based.

default-src 'none'; script-src 'nonce-78118834-c1c1-45b4-aa53-23d95c368fcd'; style-src 'unsafe-inline'; img-src https://www.redditstatic.com; form-action 'self';

Directive	Sources
default-src	'none'
script-src	'nonce-78118834-c1c1-45b4-aa53-23d95c368fcd'
style-src	'unsafe-inline'
img-src	https://www.redditstatic.com
form-action	'self'

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubdomains
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
x-xss-protection	1; mode=block
server	snooserv

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan