Content-Security-Policy

ucl.ac.uk sends an enforcing CSP. It is allowlist-based.

default-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' analytics.tiktok.com api.reeled.online *.azureedge.net cdn.unibuddy.co *.doubleclick.net *.googletagmanager.com *.mixcloud.com *.newrelic.com *.nr-data.net *.snapchat.com app.geckoform.com cdn.ucl.ac.uk challenges.cloudflare.com connect.facebook.net cookie-consent-dev.webhost.ucl.ac.uk cookie-consent.ucl.ac.uk embed.podcasts.apple.com googletagmanager.com gvdt3feo.com live.staticflickr.com maps.googleapis.com mediacentral.ucl.ac.uk momento360.com region-eu.libanswers.com qvdt3feo.com sc-static.net script.crazyegg.com siteimproveanalytics.com snap.licdn.com static.ads-twitter.com tagmanager.google.com tags.srv.stackadapt.com w.soundcloud.com www.google-analytics.com www.redditstatic.com www.ucl.ac.uk www.youtube.com; object-src 'none'; style-src 'self' 'unsafe-inline' api.reeled.online *.googletagmanager.com tagmanager.google.com tags.srv.stackadapt.com; img-src 'self' data: analytics-ipv6.tiktokw.us api.reeled.online *.cloudfront.net *.global.siteimproveanalytics.io *.google-analytics.com www.google.co.uk *.google.com www.google.ie *.googletagmanager.com libapps-eu.s3.amazonaws.com *.reddit.com *.symplectic.org *.ucl.ac.uk analytics.twitter.com googletagmanager.com i.vimeocdn.com i.ytimg.com live.staticflickr.com maps.googleapis.com maps.gstatic.com mediacentral.ucl.ac.uk momento360.com *.ads.linkedin.com ssl.gstatic.com t.co www.facebook.com www.gstatic.com *.snapchat.com; media-src 'self' *.cloudfront.net; frame-src 'self' *.dotdigital-pages.com *.doubleclick.net *.dynamics.com *.googletagmanager.com *.mixcloud.com app.geckoform.com calendar.google.com cdn.jotfor.ms docs.google.com digital-presence-services-dev.webhost.ucl.ac.uk digital-presence-services-pre.webhost.ucl.ac.uk e.issuu.com embed.podcasts.apple.com form.jotformeu.com forms.office.com forms.cloud.microsoft lccos.ucl.ac.uk library-calendars.ucl.ac.uk library-help.ucl.ac.uk maps.google.co.uk mediacentral.ucl.ac.uk momento360.com player.vimeo.com tr.snapchat.com ucl.cloud.panopto.eu w.soundcloud.com www.google.com www.microsoft.com www.ucl.ac.uk ucl-global.libwizard.com unibuddy.co www.youtube.com www.youtube-nocookie.com; frame-ancestors 'self'; child-src 'self' blob:; font-src 'self' data: cdn.ucl.ac.uk; connect-src 'self' *.analytics.google.com analytics-ipv6.tiktokw.us analytics.tiktok.com analytics.twitter.com api.reeled.online *.azureedge.net chat-eu.libanswers.com *.google-analytics.com *.googletagmanager.com *.nr-data.net *.reddit.com *.snapchat.com assets-eur.mkt.dynamics.com cookie-consent-dev.webhost.ucl.ac.uk cookie-consent.ucl.ac.uk googleads.g.doubleclick.net maps.googleapis.com public-eur.mkt.dynamics.com *.ads.linkedin.com script.crazyegg.com stats.g.doubleclick.net t.co tags.srv.stackadapt.com tr.snapchat.com www.facebook.com www.google.com

Directive	Sources
default-src	'self' data:
script-src	'self' 'unsafe-inline' 'unsafe-eval' analytics.tiktok.com api.reeled.online *.azureedge.net cdn.unibuddy.co *.doubleclick.net *.googletagmanager.com *.mixcloud.com *.newrelic.com *.nr-data.net *.snapchat.com app.geckoform.com cdn.ucl.ac.uk challenges.cloudflare.com connect.facebook.net cookie-consent-dev.webhost.ucl.ac.uk cookie-consent.ucl.ac.uk embed.podcasts.apple.com googletagmanager.com gvdt3feo.com live.staticflickr.com maps.googleapis.com mediacentral.ucl.ac.uk momento360.com region-eu.libanswers.com qvdt3feo.com sc-static.net script.crazyegg.com siteimproveanalytics.com snap.licdn.com static.ads-twitter.com tagmanager.google.com tags.srv.stackadapt.com w.soundcloud.com www.google-analytics.com www.redditstatic.com www.ucl.ac.uk www.youtube.com
object-src	'none'
style-src	'self' 'unsafe-inline' api.reeled.online *.googletagmanager.com tagmanager.google.com tags.srv.stackadapt.com
img-src	'self' data: analytics-ipv6.tiktokw.us api.reeled.online *.cloudfront.net *.global.siteimproveanalytics.io *.google-analytics.com www.google.co.uk *.google.com www.google.ie *.googletagmanager.com libapps-eu.s3.amazonaws.com *.reddit.com *.symplectic.org *.ucl.ac.uk analytics.twitter.com googletagmanager.com i.vimeocdn.com i.ytimg.com live.staticflickr.com maps.googleapis.com maps.gstatic.com mediacentral.ucl.ac.uk momento360.com *.ads.linkedin.com ssl.gstatic.com t.co www.facebook.com www.gstatic.com *.snapchat.com
media-src	'self' *.cloudfront.net
frame-src	'self' *.dotdigital-pages.com *.doubleclick.net *.dynamics.com *.googletagmanager.com *.mixcloud.com app.geckoform.com calendar.google.com cdn.jotfor.ms docs.google.com digital-presence-services-dev.webhost.ucl.ac.uk digital-presence-services-pre.webhost.ucl.ac.uk e.issuu.com embed.podcasts.apple.com form.jotformeu.com forms.office.com forms.cloud.microsoft lccos.ucl.ac.uk library-calendars.ucl.ac.uk library-help.ucl.ac.uk maps.google.co.uk mediacentral.ucl.ac.uk momento360.com player.vimeo.com tr.snapchat.com ucl.cloud.panopto.eu w.soundcloud.com www.google.com www.microsoft.com www.ucl.ac.uk ucl-global.libwizard.com unibuddy.co www.youtube.com www.youtube-nocookie.com
frame-ancestors	'self'
child-src	'self' blob:
font-src	'self' data: cdn.ucl.ac.uk
connect-src	'self' *.analytics.google.com analytics-ipv6.tiktokw.us analytics.tiktok.com analytics.twitter.com api.reeled.online *.azureedge.net chat-eu.libanswers.com *.google-analytics.com *.googletagmanager.com *.nr-data.net *.reddit.com *.snapchat.com assets-eur.mkt.dynamics.com cookie-consent-dev.webhost.ucl.ac.uk cookie-consent.ucl.ac.uk googleads.g.doubleclick.net maps.googleapis.com public-eur.mkt.dynamics.com *.ads.linkedin.com script.crazyegg.com stats.g.doubleclick.net t.co tags.srv.stackadapt.com tr.snapchat.com www.facebook.com www.google.com

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
x-content-type-options	nosniff, nosniff
referrer-policy	no-referrer-when-downgrade
x-xss-protection	1; mode=block
server	cloudflare

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan