A
squareup.com
Score 90/100 · scanned 2026-08-04Content-Security-Policy
No enforcing Content-Security-Policy on the homepage response. What that means →
Headers sent
| Header | Value |
|---|---|
content-security-policy-report-only | child-src 'self' https://*.qualified.com; default-src 'self'; frame-src 'self' https://9628652.fls.doubleclick.net https://td.doubleclick.net https://js.driftt.com https://*.qualified.com https://a844… |
strict-transport-security | max-age=631152000; includeSubDomains; preload |
x-frame-options | SAMEORIGIN |
x-content-type-options | nosniff |
referrer-policy | strict-origin-when-cross-origin |
cross-origin-opener-policy | same-origin |
cross-origin-resource-policy | same-origin |
x-xss-protection | 0 |
server | cloudflare |
Re-scan live
This is a snapshot from 2026-08-04. Check it now: