Content-Security-Policy

tumblr.com sends an enforcing CSP. It is nonce-based.

script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.recaptcha.net https://c0.pubmine.com https://s.pubmine.com https://criteo.com https://*.criteo.com https://criteo.net https://*.criteo.net https://*.vexowi.com https://vexowi.com https://c.amazon-adsystem.com https://*.3lift.com https://3lift.com https://z.moatads.com https://*.moatads.com https://*.smartadserver.com https://*.sascdn.com https://app.link https://securepubads.g.doubleclick.net https://*.googlesyndication.com https://www.googletagservices.com/ https://cdn.parsely.com https://a.teads.tv/analytics/tag.js https://assets.tumblr.com https://ads.pubmatic.com https://cdn.jsdelivr.net https://*.privacymanager.io https://*.rlcdn.com https://edge.atmtd.com https://scripts.atmtd.com https://cdn.id5-sync.com https://dn0qt3r0xannq.cloudfront.net https://*.aditude.io https://static.kueezrtb.com https://cdn.ampproject.org https://blackbox-api.wp.com https://open.spotify.com https://embed-cdn.spotifycdn.com https://sb.scorecardresearch.com https://assets.tumblr.com/pop/ 'nonce-NmNmNjMzOGNlYzExNDM2OWFjMWYyZThiYjM1M2NiZDk='; report-uri /svc/cspreports; object-src 'none'; worker-src blob: 'self'; base-uri 'self'

Directive	Sources
script-src	'self' 'unsafe-eval' 'unsafe-inline' https://www.recaptcha.net https://c0.pubmine.com https://s.pubmine.com https://criteo.com https://*.criteo.com https://criteo.net https://*.criteo.net https://*.vexowi.com https://vexowi.com https://c.amazon-adsystem.com https://*.3lift.com https://3lift.com https://z.moatads.com https://*.moatads.com https://*.smartadserver.com https://*.sascdn.com https://app.link https://securepubads.g.doubleclick.net https://*.googlesyndication.com https://www.googletagservices.com/ https://cdn.parsely.com https://a.teads.tv/analytics/tag.js https://assets.tumblr.com https://ads.pubmatic.com https://cdn.jsdelivr.net https://*.privacymanager.io https://*.rlcdn.com https://edge.atmtd.com https://scripts.atmtd.com https://cdn.id5-sync.com https://dn0qt3r0xannq.cloudfront.net https://*.aditude.io https://static.kueezrtb.com https://cdn.ampproject.org https://blackbox-api.wp.com https://open.spotify.com https://embed-cdn.spotifycdn.com https://sb.scorecardresearch.com https://assets.tumblr.com/pop/ 'nonce-NmNmNjMzOGNlYzExNDM2OWFjMWYyZThiYjM1M2NiZDk='
report-uri	/svc/cspreports
object-src	'none'
worker-src	blob: 'self'
base-uri	'self'

Headers sent

Header	Value
strict-transport-security	max-age=31536000; preload
x-frame-options	deny
x-content-type-options	nosniff
x-xss-protection	1; mode=block
server	nginx

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan