Content-Security-Policy

stanford.edu sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

default-src 'self'; script-src 'nonce-yv+TJVdtktkdloY8VUhBzCrB6Ra6hEvV' 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' https: http: 'self' 'strict-dynamic' https://*.googletagmanager.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://pagead2.googlesyndication.com https://googleads.g.doubleclick.net https://www.google.com https://*.contentsquare.net https://k.ba.contentsquare.net; style-src 'self' 'unsafe-inline' https: https://fonts.googleapis.com https://googletagmanager.com https://tagmanager.google.com; img-src 'self' blob: data: https: https://a-us.storyblok.com https://a2-us.storyblok.com https://a.storyblok.com https://*.google-analytics.com https://*.googletagmanager.com https://*.g.doubleclick.net https://www.google.com https://google.com https://ssl.gstatic.com https://www.gstatic.com; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://*.netlify.app https://api.storyblok.com https://cdn.storyblok.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://pagead2.googlesyndication.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://ad.doubleclick.net https://www.google.com https://google.com https://*.contentsquare.net; media-src 'self' https://a-us.storyblok.com https://a2-us.storyblok.com https://a.storyblok.com blob:; frame-src https://www.youtube.com https://youtube.com https://app.netlify.com https://www.googletagmanager.com https://*.contentsquare.net https://k.ba.contentsquare.net; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests; report-uri /.netlify/functions/__csp-violations

Directive	Sources
default-src	'self'
script-src	'nonce-yv+TJVdtktkdloY8VUhBzCrB6Ra6hEvV' 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' https: http: 'self' 'strict-dynamic' https://*.googletagmanager.com https://www.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://pagead2.googlesyndication.com https://googleads.g.doubleclick.net https://www.google.com https://*.contentsquare.net https://k.ba.contentsquare.net
style-src	'self' 'unsafe-inline' https: https://fonts.googleapis.com https://googletagmanager.com https://tagmanager.google.com
img-src	'self' blob: data: https: https://a-us.storyblok.com https://a2-us.storyblok.com https://a.storyblok.com https://*.google-analytics.com https://*.googletagmanager.com https://*.g.doubleclick.net https://www.google.com https://google.com https://ssl.gstatic.com https://www.gstatic.com
font-src	'self' data: https://fonts.gstatic.com
connect-src	'self' https://*.netlify.app https://api.storyblok.com https://cdn.storyblok.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://pagead2.googlesyndication.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://ad.doubleclick.net https://www.google.com https://google.com https://*.contentsquare.net
media-src	'self' https://a-us.storyblok.com https://a2-us.storyblok.com https://a.storyblok.com blob:
frame-src	https://www.youtube.com https://youtube.com https://app.netlify.com https://www.googletagmanager.com https://*.contentsquare.net https://k.ba.contentsquare.net
frame-ancestors	'none'
base-uri	'self'
form-action	'self'
object-src	'none'
upgrade-insecure-requests	(empty)
report-uri	/.netlify/functions/__csp-violations

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-frame-options	DENY
x-content-type-options	nosniff
referrer-policy	origin-when-cross-origin
permissions-policy	vibrate=(), geolocation=(self), midi=(), notifications=(), push=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), speaker=()
server	Netlify
x-powered-by	Next.js

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan