Content-Security-Policy

visa.com sends an enforcing CSP. It is allowlist-based.

self

Directive	Sources
self	(empty)

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubdomains;
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff, nosniff
referrer-policy	strict-origin-when-cross-origin, no-referrer-when-downgrade
x-xss-protection	1; mode=block
server	cloudflare

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan