wayfair.com

Score 35/100 · scanned 2026-08-04

Content-Security-Policy

wayfair.com sends an enforcing CSP. It is allowlist-based.

frame-ancestors self https://*.wayfair.com https://*.wayfair.ca https://*.wayfair.co.uk https://*.wayfair.de https://*.wayfair.ie https://*.jossandmain.com https://*.allmodern.com https://*.birchlane.com https://*.perigold.com

Directive	Sources
`frame-ancestors`	`self https://.wayfair.com https://.wayfair.ca https://.wayfair.co.uk https://.wayfair.de https://.wayfair.ie https://.jossandmain.com https://.allmodern.com https://.birchlane.com https://*.perigold.com`

Headers sent

Header	Value
`strict-transport-security`	`max-age=15552000; includeSubDomains; preload`
`x-frame-options`	`SAMEORIGIN`
`server`	`cloudflare`

Critical findings

No script-src and no default-src, so the policy places no restriction on scripts at all.Add script-src with a nonce or hash, or at minimum default-src 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: