Content-Security-Policy

tudelft.nl sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

default-src 'self'; script-src 'strict-dynamic' 'nonce-c063929a17469dcccb8ab3dd1e83f88c' 'report-sample'; style-src-attr 'unsafe-inline' 'report-sample'; img-src 'self' data: *.ytimg.com *.vimeocdn.com s.e7096c671.entry.domains filelist.delft.university *.openstreetmap.org *.tudelft.nl *.siteimproveanalytics.io *.browsealoud.com *.usercentrics.eu https://s.e7096c671.entry.domains https://filelist.tudelft.nl https://t.e7096c671.entry.domains/; base-uri 'self'; frame-src 'self' *.youtube-nocookie.com *.youtube.com *.vimeo.com *.intractive.app *.cookiebot.eu *.tudelft.nl; style-src 'self' 'unsafe-inline' data: https://fonts.googleapis.com *.typekit.net 'report-sample'; media-src 'self' data: blob: s.e7096c671.entry.domains filelist.delft.university *.tudelft.nl https://s.e7096c671.entry.domains https://filelist.tudelft.nl; font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com *.typekit.net; connect-src 'self' wss: s.e7096c671.entry.domains filelist.delft.university *.openstreetmap.org *.browsealoud.com *.tudelft.nl *.speechstream.net *.cookiebot.eu *.4tu.nl *.typesense.net https://s.e7096c671.entry.domains https://filelist.tudelft.nl; script-src-elem 'strict-dynamic' 'nonce-c063929a17469dcccb8ab3dd1e83f88c' https://cdnjs.cloudflare.com *.browsealoud.com *.tudelft.nl 'report-sample'; report-uri https://www.tudelft.nl/@http-reporting?csp=report&requestTime=1785852942356768&requestHash=ccb9e20bf6fc54b4a11725b76e1ee7c2bbd8902a

Directive	Sources
default-src	'self'
script-src	'strict-dynamic' 'nonce-c063929a17469dcccb8ab3dd1e83f88c' 'report-sample'
style-src-attr	'unsafe-inline' 'report-sample'
img-src	'self' data: *.ytimg.com *.vimeocdn.com s.e7096c671.entry.domains filelist.delft.university *.openstreetmap.org *.tudelft.nl *.siteimproveanalytics.io *.browsealoud.com *.usercentrics.eu https://s.e7096c671.entry.domains https://filelist.tudelft.nl https://t.e7096c671.entry.domains/
base-uri	'self'
frame-src	'self' *.youtube-nocookie.com *.youtube.com *.vimeo.com *.intractive.app *.cookiebot.eu *.tudelft.nl
style-src	'self' 'unsafe-inline' data: https://fonts.googleapis.com *.typekit.net 'report-sample'
media-src	'self' data: blob: s.e7096c671.entry.domains filelist.delft.university *.tudelft.nl https://s.e7096c671.entry.domains https://filelist.tudelft.nl
font-src	'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com *.typekit.net
connect-src	'self' wss: s.e7096c671.entry.domains filelist.delft.university *.openstreetmap.org *.browsealoud.com *.tudelft.nl *.speechstream.net *.cookiebot.eu *.4tu.nl *.typesense.net https://s.e7096c671.entry.domains https://filelist.tudelft.nl
script-src-elem	'strict-dynamic' 'nonce-c063929a17469dcccb8ab3dd1e83f88c' https://cdnjs.cloudflare.com *.browsealoud.com *.tudelft.nl 'report-sample'
report-uri	https://www.tudelft.nl/@http-reporting?csp=report&requestTime=1785852942356768&requestHash=ccb9e20bf6fc54b4a11725b76e1ee7c2bbd8902a

Headers sent

Header	Value
strict-transport-security	max-age=31536000
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
referrer-policy	same-origin
x-xss-protection	1; mode=block

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan