F
walmart.com
Score 35/100 · scanned 2026-08-04Content-Security-Policy
walmart.com sends an enforcing CSP. It is allowlist-based.
frame-ancestors 'self' *.wal.co *.walmart-customcards.com *.walmart.com:* *.walmart.net *.walmartimages.com; report-uri https://csp.walmart.com/c/r/gl
| Directive | Sources |
|---|---|
frame-ancestors | 'self' *.wal.co *.walmart-customcards.com *.walmart.com:* *.walmart.net *.walmartimages.com |
report-uri | https://csp.walmart.com/c/r/gl |
Headers sent
| Header | Value |
|---|---|
strict-transport-security | max-age=31536000 |
x-frame-options | SAMEORIGIN |
permissions-policy | ch-dpr=(self "https://i5.walmartimages.com"), ch-device-memory=(self "https://i5.walmartimages.com") |
Critical findings
No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.
Re-scan live
This is a snapshot from 2026-08-04. Check it now: