theguardian.com

Score 55/100 · scanned 2026-08-04

Content-Security-Policy

theguardian.com sends an enforcing CSP. It is allowlist-based.

upgrade-insecure-requests; default-src https:; script-src https: 'unsafe-inline' 'unsafe-eval' blob: 'unsafe-inline'; frame-src https: data:; style-src https: 'unsafe-inline'; img-src https: data: blob:; media-src https: data: blob:; font-src 'self' https://assets.guim.co.uk https://pasteup.guim.co.uk https://interactive.guim.co.uk https://dashboard.ophan.co.uk https://cdn.braze.eu data:; connect-src https: wss: blob:; child-src https: blob:; object-src 'none'; base-uri 'none'

Directive	Sources
`upgrade-insecure-requests`	`(empty)`
`default-src`	`https:`
`script-src`	`https: 'unsafe-inline' 'unsafe-eval' blob: 'unsafe-inline'`
`frame-src`	`https: data:`
`style-src`	`https: 'unsafe-inline'`
`img-src`	`https: data: blob:`
`media-src`	`https: data: blob:`
`font-src`	`'self' https://assets.guim.co.uk https://pasteup.guim.co.uk https://interactive.guim.co.uk https://dashboard.ophan.co.uk https://cdn.braze.eu data:`
`connect-src`	`https: wss: blob:`
`child-src`	`https: blob:`
`object-src`	`'none'`
`base-uri`	`'none'`

Headers sent

Header	Value
`strict-transport-security`	`max-age=63072000; includeSubDomains; preload`
`x-frame-options`	`SAMEORIGIN`
`x-content-type-options`	`nosniff`
`referrer-policy`	`no-referrer-when-downgrade`
`permissions-policy`	`camera=(), microphone=(), midi=(), geolocation=(), interest-cohort=(), clipboard-read=(), unload=()`
`x-xss-protection`	`1; mode=block`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: