usps.com

Score 55/100 · scanned 2026-08-04

Content-Security-Policy

usps.com sends an enforcing CSP. It is allowlist-based.

default-src 'self' https:;                                              connect-src 'self' https:;                                              font-src 'self' https: data:;                                              frame-src 'self' https:;                                              img-src 'self' https: data:; media-src 'self' https:;                                              object-src 'self' https:;                                              script-src 'self' 'unsafe-inline' 'unsafe-eval' https:;                                              style-src 'self' 'unsafe-inline' https:;

Directive	Sources
`default-src`	`'self' https:`
`connect-src`	`'self' https:`
`font-src`	`'self' https: data:`
`frame-src`	`'self' https:`
`img-src`	`'self' https: data:`
`media-src`	`'self' https:`
`object-src`	`'self' https:`
`script-src`	`'self' 'unsafe-inline' 'unsafe-eval' https:`
`style-src`	`'self' 'unsafe-inline' https:`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000 ; includeSubDomains`
`x-frame-options`	`SAMEORIGIN`
`x-content-type-options`	`nosniff`
`access-control-allow-origin`	`https://www.usps.com`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: