Content-Security-Policy

sophos.com sends an enforcing CSP. It is allowlist-based.

default-src 'self'; img-src 'self' https://*.google.com https://www.googletagmanager.com data: https://*.qualified.com https://cdn.cookielaw.org https://*.contentstack.com https://*.contentstack.io https://*.contentstackapps.com https://*.contentstackapps.io https://*.sophos.com https://www.secureworks.com https://api.sitelytics.tech https://*.adnxs.com https://*.linkedin.com https://bat.bing.com https://*.lijit.com https://*.6sc.co https://*.6sense.com https://*.googlesyndication.com https://*.ytimg.com https://*.eloqua.com https://*.doubleclick.net https://*.googleadservices.com https://*.vimeocdn.com https://pixel.mathtag.com https://image2.pubmatic.com https://placehold.co; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.qualified.com https://*.cookielaw.org https://*.contentstack.com https://*.contentstack.io https://*.contentstackapps.com https://*.sophos.com https://www.gstatic.com https://www.googletagmanager.com https://*.contentsquare.net https://*.go-mpulse.net https://*.google.com https://www.google.co.uk https://*.google-analytics.com https://bat.bing.com https://snap.licdn.com https://*.lijit.com https://api.sitelytics.tech https://static.xingcdn.com https://*.driftapi.com https://cdn.delivr.ai https://*.doubleclick.net https://driftt.imgix.net https://*.eloqua.com https://*.adnxs.com https://*.fullstory.com https://ws.zoominfo.com https://*.drift.com https://www.xing.com https://*.visualwebsiteoptimizer.com https://*.6sc.co https://*.6sense.com https://img03.en25.com https://*.youtube.com https://*.leandata.com https://*.dpmsrv.com https://*.claydar.com; style-src 'self' 'unsafe-inline' https://*.sophos.com https://*.qualified.com https://*.contentstack.io https://*.contentstack.com https://*.contentstackapps.com https://*.contentstackapps.io; font-src 'self' https: data:; connect-src 'self' https://*.qualified.com wss://*.qualified.com https://*.contentstack.io https://*.contentstack.com https://*.contentstackapps.com https://*.contentsquare.net https://*.sophos.com https://www.googletagmanager.com https://www.gstatic.com https://cdn.cookielaw.org https://geolocation.onetrust.com wss://*.pusher.com https://*.pusher.com wss://ws7.qualified.com https://*.go-mpulse.net https://*.akstat.io https://*.akamaihd.net https://www.xing.com https://cdn.delivr.ai https://*.google.com https://www.google.co.uk https://*.google-analytics.com https://bat.bing.com https://snap.licdn.com https://*.lijit.com https://api.sitelytics.tech https://static.xingcdn.com https://*.driftapi.com https://*.doubleclick.net https://driftt.imgix.net https://*.eloqua.com https://*.adnxs.com https://*.fullstory.com https://ws.zoominfo.com https://*.drift.com https://*.linkedin.com https://*.visualwebsiteoptimizer.com https://*.6sc.co https://*.bing.net https://*.6sense.com https://*.googlesyndication.com https://*.leandata.com https://*.googleadservices.com https://*.claydar.com https://sophos-privacy.my.onetrust.com; frame-src 'self' blob: https://*.contentstackapps.com https://*.youtube-nocookie.com https://w.soundcloud.com https://*.qualified.com https://*.sophos.com https://*.google.com https://player.vimeo.com https://*.youtube.com https://*.contentstack.io https://www.googletagmanager.com https://*.doubleclick.net https://*.6sc.co https://*.vidyard.com https://*.lijit.com https://*.leandata.com https://assets.contentstack.io; frame-ancestors 'self' https://*.sophos.com; media-src 'self' https://assets.contentstack.io https://*.sophos.com https://*.qualified.com mediastream:; child-src 'self' blob: https://*.qualified.com https://*.contentstackapps.com; object-src 'none'; report-uri https://sophos.report-uri.com/r/d/csp/enforce;

Directive	Sources
default-src	'self'
img-src	'self' https://*.google.com https://www.googletagmanager.com data: https://*.qualified.com https://cdn.cookielaw.org https://*.contentstack.com https://*.contentstack.io https://*.contentstackapps.com https://*.contentstackapps.io https://*.sophos.com https://www.secureworks.com https://api.sitelytics.tech https://*.adnxs.com https://*.linkedin.com https://bat.bing.com https://*.lijit.com https://*.6sc.co https://*.6sense.com https://*.googlesyndication.com https://*.ytimg.com https://*.eloqua.com https://*.doubleclick.net https://*.googleadservices.com https://*.vimeocdn.com https://pixel.mathtag.com https://image2.pubmatic.com https://placehold.co
script-src	'self' 'unsafe-inline' 'unsafe-eval' https://*.qualified.com https://*.cookielaw.org https://*.contentstack.com https://*.contentstack.io https://*.contentstackapps.com https://*.sophos.com https://www.gstatic.com https://www.googletagmanager.com https://*.contentsquare.net https://*.go-mpulse.net https://*.google.com https://www.google.co.uk https://*.google-analytics.com https://bat.bing.com https://snap.licdn.com https://*.lijit.com https://api.sitelytics.tech https://static.xingcdn.com https://*.driftapi.com https://cdn.delivr.ai https://*.doubleclick.net https://driftt.imgix.net https://*.eloqua.com https://*.adnxs.com https://*.fullstory.com https://ws.zoominfo.com https://*.drift.com https://www.xing.com https://*.visualwebsiteoptimizer.com https://*.6sc.co https://*.6sense.com https://img03.en25.com https://*.youtube.com https://*.leandata.com https://*.dpmsrv.com https://*.claydar.com
style-src	'self' 'unsafe-inline' https://*.sophos.com https://*.qualified.com https://*.contentstack.io https://*.contentstack.com https://*.contentstackapps.com https://*.contentstackapps.io
font-src	'self' https: data:
connect-src	'self' https://*.qualified.com wss://*.qualified.com https://*.contentstack.io https://*.contentstack.com https://*.contentstackapps.com https://*.contentsquare.net https://*.sophos.com https://www.googletagmanager.com https://www.gstatic.com https://cdn.cookielaw.org https://geolocation.onetrust.com wss://*.pusher.com https://*.pusher.com wss://ws7.qualified.com https://*.go-mpulse.net https://*.akstat.io https://*.akamaihd.net https://www.xing.com https://cdn.delivr.ai https://*.google.com https://www.google.co.uk https://*.google-analytics.com https://bat.bing.com https://snap.licdn.com https://*.lijit.com https://api.sitelytics.tech https://static.xingcdn.com https://*.driftapi.com https://*.doubleclick.net https://driftt.imgix.net https://*.eloqua.com https://*.adnxs.com https://*.fullstory.com https://ws.zoominfo.com https://*.drift.com https://*.linkedin.com https://*.visualwebsiteoptimizer.com https://*.6sc.co https://*.bing.net https://*.6sense.com https://*.googlesyndication.com https://*.leandata.com https://*.googleadservices.com https://*.claydar.com https://sophos-privacy.my.onetrust.com
frame-src	'self' blob: https://*.contentstackapps.com https://*.youtube-nocookie.com https://w.soundcloud.com https://*.qualified.com https://*.sophos.com https://*.google.com https://player.vimeo.com https://*.youtube.com https://*.contentstack.io https://www.googletagmanager.com https://*.doubleclick.net https://*.6sc.co https://*.vidyard.com https://*.lijit.com https://*.leandata.com https://assets.contentstack.io
frame-ancestors	'self' https://*.sophos.com
media-src	'self' https://assets.contentstack.io https://*.sophos.com https://*.qualified.com mediastream:
child-src	'self' blob: https://*.qualified.com https://*.contentstackapps.com
object-src	'none'
report-uri	https://sophos.report-uri.com/r/d/csp/enforce

Headers sent

Header	Value
strict-transport-security	max-age=31536000 ; includeSubDomains ; preload
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
permissions-policy	geolocation=(), microphone=(self "https://app.qualified.com"), camera=(self "https://app.qualified.com")

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan