Content-Security-Policy

robinhood.com sends an enforcing CSP. It is allowlist-based.

default-src 'none'; script-src 'self' cdn.robinhood.com cdn.pdst.fm/ping.min.js 'unsafe-inline' *.google-analytics.com *.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ tagmanager.google.com connect.facebook.net sc-static.net d.impactradius-event.com www.redditstatic.com analytics.tiktok.com boards.greenhouse.io bat.bing.com www.googleadservices.com googleads.g.doubleclick.net pagead2.googlesyndication.com web-sdk-cdn.singular.net/singular-gtm-interface/latest/singular-gtm-interface.js web-sdk-cdn.singular.net/singular-sdk/latest/singular-sdk.js static.ads-twitter.com s.yimg.com *.usercentrics.eu snap.licdn.com collector-47804.us.tvsquared.com/tv2track.js js.stripe.com 'wasm-unsafe-eval' https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js ; worker-src 'self' blob: ; frame-src www.google.com/recaptcha/ www.youtube.com/iframe_api/ www.youtube.com/embed/ www.googletagmanager.com boards.greenhouse.io tr6.snapchat.com tr.snapchat.com fcm.quick1fr.com js.stripe.com *.usercentrics.eu https://preview.widgets.ninetailed.io/ https://*.fls.doubleclick.net/ https://widget.trustpilot.com ; style-src 'self' 'unsafe-inline' cdn.robinhood.com tagmanager.google.com fonts.googleapis.com ; font-src 'self' cdn.robinhood.com js.stripe.com data: ; media-src 'self' cdn.robinhood.com *.usercentrics.eu videos.ctfassets.net/ilblxxee70tt/ videos.ctfassets.net/1hpl803w8xsv/ data: ; img-src 'self' images.robinhood.com px4.ads.linkedin.com cdn.robinhood.com *.google-analytics.com *.g.doubleclick.net i.ytimg.com/vi/ images.ctfassets.net downloads.ctfassets.net *.googletagmanager.com ssl.gstatic.com www.gstatic.com www.facebook.com www.google.com google.com pagead2.googlesyndication.com www.google.ca www.google.co.uk www.google.de www.google.fr www.google.es www.google.it www.google.nl www.google.be www.google.at www.google.ie www.google.pt www.google.pl www.google.se www.google.dk www.google.fi www.google.com.au www.google.co.jp www.googleadservices.com ade.googlesyndication.com adservice.google.com tr.snapchat.com tr6.snapchat.com bat.bing.com ad.doubleclick.net pixel.pointmediatracker.com cnv.event.prod.bidr.io/log/cnv data: alb.reddit.com analytics.twitter.com t.co sp.analytics.yahoo.com *.usercentrics.eu cdn.blisspointmedia.com/assets/img/ px.ads.linkedin.com collector-47804.us.tvsquared.com/tv2track.php images.ctfassets.net/ilblxxee70tt/ images.ctfassets.net/1hpl803w8xsv/ https://lh7-us.googleusercontent.com https://lh7-rt.googleusercontent.com blob: ; frame-ancestors 'self' https://app.contentful.com ; manifest-src 'self' cdn.robinhood.com ; connect-src 'self' robinhood.com *.robinhood.com *.x1creditcard.com *.apollo.rhinternal.net *.staging.rhinternal.net ak.sail-horizon.com *.google-analytics.com *.analytics.google.com *.g.doubleclick.net bat.bing.com/actionp/ bat.bing.com/p/conversions/ us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink sentry.io o62437.ingest.sentry.io *.googletagmanager.com tagmanager.google.com www.google.com/ccm/collect www.google.com/gmp/conversion www.google.com/pagead/1p-conversion/ www.google.com/rmkt/collect/ www.google.com/recaptcha/ www.googleadservices.com/pagead/conversion/ google.com pagead2.googlesyndication.com www.google.ca www.google.co.uk www.google.de www.google.fr www.google.es www.google.it www.google.nl www.google.be www.google.at www.google.ie www.google.pt www.google.pl www.google.se www.google.dk www.google.fi www.google.com.au www.google.co.jp www.facebook.com/privacy_sandbox/topics/registration/ ad.doubleclick.net www.redditstatic.com/ads/conversions-config/v1/pixel/config/ pixel-config.reddit.com/pixels/ conversions-config.reddit.com/v1/pixel/ analytics.tiktok.com sdk-api-v1.singular.net/api/v1/event boards-api.greenhouse.io preview.contentful.com cdn.contentful.com experience.ninetailed.co s.yimg.com *.usercentrics.eu api.instagram.com/ px.ads.linkedin.com assets.ctfassets.net/ilblxxee70tt/ assets.ctfassets.net/1hpl803w8xsv/ https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js.map https://ingest.insights.ninetailed.co js.stripe.com ; upgrade-insecure-requests; block-all-mixed-content; report-uri https://o62437.ingest.sentry.io/api/1336410/security/?sentry_key=dadc326d25814a55b5486cb04f439a29; base-uri 'self'

Directive	Sources
default-src	'none'
script-src	'self' cdn.robinhood.com cdn.pdst.fm/ping.min.js 'unsafe-inline' *.google-analytics.com *.googletagmanager.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ tagmanager.google.com connect.facebook.net sc-static.net d.impactradius-event.com www.redditstatic.com analytics.tiktok.com boards.greenhouse.io bat.bing.com www.googleadservices.com googleads.g.doubleclick.net pagead2.googlesyndication.com web-sdk-cdn.singular.net/singular-gtm-interface/latest/singular-gtm-interface.js web-sdk-cdn.singular.net/singular-sdk/latest/singular-sdk.js static.ads-twitter.com s.yimg.com *.usercentrics.eu snap.licdn.com collector-47804.us.tvsquared.com/tv2track.js js.stripe.com 'wasm-unsafe-eval' https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
worker-src	'self' blob:
frame-src	www.google.com/recaptcha/ www.youtube.com/iframe_api/ www.youtube.com/embed/ www.googletagmanager.com boards.greenhouse.io tr6.snapchat.com tr.snapchat.com fcm.quick1fr.com js.stripe.com *.usercentrics.eu https://preview.widgets.ninetailed.io/ https://*.fls.doubleclick.net/ https://widget.trustpilot.com
style-src	'self' 'unsafe-inline' cdn.robinhood.com tagmanager.google.com fonts.googleapis.com
font-src	'self' cdn.robinhood.com js.stripe.com data:
media-src	'self' cdn.robinhood.com *.usercentrics.eu videos.ctfassets.net/ilblxxee70tt/ videos.ctfassets.net/1hpl803w8xsv/ data:
img-src	'self' images.robinhood.com px4.ads.linkedin.com cdn.robinhood.com *.google-analytics.com *.g.doubleclick.net i.ytimg.com/vi/ images.ctfassets.net downloads.ctfassets.net *.googletagmanager.com ssl.gstatic.com www.gstatic.com www.facebook.com www.google.com google.com pagead2.googlesyndication.com www.google.ca www.google.co.uk www.google.de www.google.fr www.google.es www.google.it www.google.nl www.google.be www.google.at www.google.ie www.google.pt www.google.pl www.google.se www.google.dk www.google.fi www.google.com.au www.google.co.jp www.googleadservices.com ade.googlesyndication.com adservice.google.com tr.snapchat.com tr6.snapchat.com bat.bing.com ad.doubleclick.net pixel.pointmediatracker.com cnv.event.prod.bidr.io/log/cnv data: alb.reddit.com analytics.twitter.com t.co sp.analytics.yahoo.com *.usercentrics.eu cdn.blisspointmedia.com/assets/img/ px.ads.linkedin.com collector-47804.us.tvsquared.com/tv2track.php images.ctfassets.net/ilblxxee70tt/ images.ctfassets.net/1hpl803w8xsv/ https://lh7-us.googleusercontent.com https://lh7-rt.googleusercontent.com blob:
frame-ancestors	'self' https://app.contentful.com
manifest-src	'self' cdn.robinhood.com
connect-src	'self' robinhood.com *.robinhood.com *.x1creditcard.com *.apollo.rhinternal.net *.staging.rhinternal.net ak.sail-horizon.com *.google-analytics.com *.analytics.google.com *.g.doubleclick.net bat.bing.com/actionp/ bat.bing.com/p/conversions/ us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink sentry.io o62437.ingest.sentry.io *.googletagmanager.com tagmanager.google.com www.google.com/ccm/collect www.google.com/gmp/conversion www.google.com/pagead/1p-conversion/ www.google.com/rmkt/collect/ www.google.com/recaptcha/ www.googleadservices.com/pagead/conversion/ google.com pagead2.googlesyndication.com www.google.ca www.google.co.uk www.google.de www.google.fr www.google.es www.google.it www.google.nl www.google.be www.google.at www.google.ie www.google.pt www.google.pl www.google.se www.google.dk www.google.fi www.google.com.au www.google.co.jp www.facebook.com/privacy_sandbox/topics/registration/ ad.doubleclick.net www.redditstatic.com/ads/conversions-config/v1/pixel/config/ pixel-config.reddit.com/pixels/ conversions-config.reddit.com/v1/pixel/ analytics.tiktok.com sdk-api-v1.singular.net/api/v1/event boards-api.greenhouse.io preview.contentful.com cdn.contentful.com experience.ninetailed.co s.yimg.com *.usercentrics.eu api.instagram.com/ px.ads.linkedin.com assets.ctfassets.net/ilblxxee70tt/ assets.ctfassets.net/1hpl803w8xsv/ https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js.map https://ingest.insights.ninetailed.co js.stripe.com
upgrade-insecure-requests	(empty)
block-all-mixed-content	(empty)
report-uri	https://o62437.ingest.sentry.io/api/1336410/security/?sentry_key=dadc326d25814a55b5486cb04f439a29
base-uri	'self'

Headers sent

Header	Value
strict-transport-security	max-age=31536000, max-age=31536000
x-frame-options	deny
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
x-xss-protection	1; mode=block
server	envoy

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan