Content-Security-Policy

wise.com sends an enforcing CSP. It is allowlist-based.

report-uri /csp;child-src 'self' 'self' blob:;connect-src *;default-src 'self';img-src 'self' data: blob: *.facebook.com https://wise.com https://wise-sandbox.com https://gtm.wise.com https://sst.wise.com https://tw-avatar.s3.eu-central-1.amazonaws.com https://tw-test-avatar-storage.s3.eu-west-1.amazonaws.com https://*.doubleclick.net https://www.googleadservices.com https://alb.reddit.com https://*.yahoo.co.jp https://bat.bing.com https://cx.atdmt.com https://daw291njkc3ao.cloudfront.net https://dq8dwmysp7hk1.cloudfront.net https://d2dgj1jjqgsb96.cloudfront.net https://help.wise.com/ https://platform-lookaside.fbsbx.com https://pixel.pointmediatracker.com https://cnv.event.prod.bidr.io https://q.quora.com https://s3-eu-west-1.amazonaws.com https://t.co https://wise.desk.com https://widgets.wise.com https://www.google-analytics.com https://www.gstatic.com https://i.ytimg.com https://px.ads.linkedin.com https://www.linkedin.com https://aax-eu.amazon-adsystem.com https://www.googletagmanager.com https://www.google.com https://www.google.com.au https://www.google.com.br https://www.google.com.sg https://www.google.com.ph https://www.google.com.my https://www.google.com.mx https://www.google.com.ua https://www.google.com.vn https://www.google.com.tr https://www.google.com.ar https://www.google.com.hk https://www.google.com.pk https://www.google.com.pe https://www.google.com.ng https://www.google.com.cy https://www.google.com.mt https://www.google.com.bd https://www.google.com.eg https://www.google.co.uk https://www.google.co.th https://www.google.co.jp https://www.google.co.nz https://www.google.co.id https://www.google.co.kr https://www.google.co.ve https://www.google.co.in https://www.google.co.il https://www.google.co.za https://www.google.de https://www.google.ca https://www.google.es https://www.google.pl https://www.google.ie https://www.google.ch https://www.google.pt https://www.google.nl https://www.google.it https://www.google.hu https://www.google.fr https://www.google.be https://www.google.ro https://www.google.fi https://www.google.cl https://www.google.cz https://www.google.ae https://www.google.lu https://www.google.se https://www.google.ru https://www.google.at https://www.google.bg https://www.google.ee https://www.google.dk https://www.google.no https://www.google.gr https://www.google.sk https://www.google.lt https://www.google.lv https://www.google.ge https://www.google.hr https://www.google.me *.googleusercontent.com *.analytics.google.com http://wi.se https://wi.se https://collector-20079.tvsquared.com https://analytics.twitter.com https://tr.line.me https://c5.adalyser.com https://c0.adalyser.com https://i.sng.link https://cdn.braze.eu https://pixel.pointmediatracker.com https://cnv.event.prod.bidr.io https://lux.speedcurve.com https://forms-eu1.hsforms.com/ https://analytics.google.com/g/s/collect;font-src 'self' data: https://fonts.gstatic.com https://widgets.wise.com/;object-src 'self';media-src 'self' 'self' data: https://wise.com/;manifest-src 'self' 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' 'self' https://wise.com https://wise-sandbox.com https://sst.wise.com https://gtm.wise.com https://*.singular.net https://i.sng.link https://js-agent.newrelic.com https://bam.nr-data.net/ https://ajax.cloudflare.com bat.bing.com https://s.yimg.jp https://*.yahoo.co.jp a.quora.com static.hotjar.com https://script.hotjar.com/ https://collector-20079.tvsquared.com https://d.line-scdn.net www.google.co.uk www.google.com www.googletagmanager.com/ tagmanager.google.com/ https://storage.googleapis.com https://ajax.googleapis.com/ https://microapps.google.com https://microapps-prod-tt.sandbox.google.com googleads.g.doubleclick.net www.google-analytics.com www.googleadservices.com static.ads-twitter.com analytics.twitter.com www.snapengage.com insitez.blob.core.windows.net sjs.bizographics.com *.mxpnl.com https://cdn.pdst.fm https://us-central1-adaptive-growth.cloudfunctions.net https://bidr.io https://d2dgj1jjqgsb96.cloudfront.net https://www.redditstatic.com/ads/pixel.js https://snap.licdn.com https://js.adsrvr.org https://c5.adalyser.com https://c0.adalyser.com https://c.amazon-adsystem.com https://js-eu1.hs-scripts.com https://js.appboycdn.com https://decagon.ai https://transferwise.com https://bidr.io https://cdn.speedcurve.com https://lux.speedcurve.com https://js-eu1.hsforms.net https://challenges.cloudflare.com https://www.youtube.com;style-src 'self' 'unsafe-inline' blob: fonts.googleapis.com/css tagmanager.google.com/;frame-ancestors 'self' https://wiseturkiye.com.tr https://microapps.google.com https://microapps-prod-tt.sandbox.google.com;frame-src youtube.com www.youtube.com www.youtube-nocookie.com https://vars.hotjar.com https://bid.g.doubleclick.net https://www.googletagmanager.com https://insight.adsrvr.org https://match.adsrvr.org https://wise.com https://wise-sandbox.com https://gtm.wise.com https://dev-wi.se https://decagon.ai https://transferwise.com https://wise.navattic.com https://js-eu1.hsforms.net https://forms-eu1.hsforms.com/ https://challenges.cloudflare.com https://feedback.wise.com;worker-src 'self' blob:;form-action 'self' https://forms-eu1.hsforms.com/;base-uri 'self';script-src-attr 'none';upgrade-insecure-requests

Directive	Sources
report-uri	/csp
child-src	'self' 'self' blob:
connect-src	*
default-src	'self'
img-src	'self' data: blob: *.facebook.com https://wise.com https://wise-sandbox.com https://gtm.wise.com https://sst.wise.com https://tw-avatar.s3.eu-central-1.amazonaws.com https://tw-test-avatar-storage.s3.eu-west-1.amazonaws.com https://*.doubleclick.net https://www.googleadservices.com https://alb.reddit.com https://*.yahoo.co.jp https://bat.bing.com https://cx.atdmt.com https://daw291njkc3ao.cloudfront.net https://dq8dwmysp7hk1.cloudfront.net https://d2dgj1jjqgsb96.cloudfront.net https://help.wise.com/ https://platform-lookaside.fbsbx.com https://pixel.pointmediatracker.com https://cnv.event.prod.bidr.io https://q.quora.com https://s3-eu-west-1.amazonaws.com https://t.co https://wise.desk.com https://widgets.wise.com https://www.google-analytics.com https://www.gstatic.com https://i.ytimg.com https://px.ads.linkedin.com https://www.linkedin.com https://aax-eu.amazon-adsystem.com https://www.googletagmanager.com https://www.google.com https://www.google.com.au https://www.google.com.br https://www.google.com.sg https://www.google.com.ph https://www.google.com.my https://www.google.com.mx https://www.google.com.ua https://www.google.com.vn https://www.google.com.tr https://www.google.com.ar https://www.google.com.hk https://www.google.com.pk https://www.google.com.pe https://www.google.com.ng https://www.google.com.cy https://www.google.com.mt https://www.google.com.bd https://www.google.com.eg https://www.google.co.uk https://www.google.co.th https://www.google.co.jp https://www.google.co.nz https://www.google.co.id https://www.google.co.kr https://www.google.co.ve https://www.google.co.in https://www.google.co.il https://www.google.co.za https://www.google.de https://www.google.ca https://www.google.es https://www.google.pl https://www.google.ie https://www.google.ch https://www.google.pt https://www.google.nl https://www.google.it https://www.google.hu https://www.google.fr https://www.google.be https://www.google.ro https://www.google.fi https://www.google.cl https://www.google.cz https://www.google.ae https://www.google.lu https://www.google.se https://www.google.ru https://www.google.at https://www.google.bg https://www.google.ee https://www.google.dk https://www.google.no https://www.google.gr https://www.google.sk https://www.google.lt https://www.google.lv https://www.google.ge https://www.google.hr https://www.google.me *.googleusercontent.com *.analytics.google.com http://wi.se https://wi.se https://collector-20079.tvsquared.com https://analytics.twitter.com https://tr.line.me https://c5.adalyser.com https://c0.adalyser.com https://i.sng.link https://cdn.braze.eu https://pixel.pointmediatracker.com https://cnv.event.prod.bidr.io https://lux.speedcurve.com https://forms-eu1.hsforms.com/ https://analytics.google.com/g/s/collect
font-src	'self' data: https://fonts.gstatic.com https://widgets.wise.com/
object-src	'self'
media-src	'self' 'self' data: https://wise.com/
manifest-src	'self' 'self'
script-src	'self' 'unsafe-inline' 'unsafe-eval' 'self' https://wise.com https://wise-sandbox.com https://sst.wise.com https://gtm.wise.com https://*.singular.net https://i.sng.link https://js-agent.newrelic.com https://bam.nr-data.net/ https://ajax.cloudflare.com bat.bing.com https://s.yimg.jp https://*.yahoo.co.jp a.quora.com static.hotjar.com https://script.hotjar.com/ https://collector-20079.tvsquared.com https://d.line-scdn.net www.google.co.uk www.google.com www.googletagmanager.com/ tagmanager.google.com/ https://storage.googleapis.com https://ajax.googleapis.com/ https://microapps.google.com https://microapps-prod-tt.sandbox.google.com googleads.g.doubleclick.net www.google-analytics.com www.googleadservices.com static.ads-twitter.com analytics.twitter.com www.snapengage.com insitez.blob.core.windows.net sjs.bizographics.com *.mxpnl.com https://cdn.pdst.fm https://us-central1-adaptive-growth.cloudfunctions.net https://bidr.io https://d2dgj1jjqgsb96.cloudfront.net https://www.redditstatic.com/ads/pixel.js https://snap.licdn.com https://js.adsrvr.org https://c5.adalyser.com https://c0.adalyser.com https://c.amazon-adsystem.com https://js-eu1.hs-scripts.com https://js.appboycdn.com https://decagon.ai https://transferwise.com https://bidr.io https://cdn.speedcurve.com https://lux.speedcurve.com https://js-eu1.hsforms.net https://challenges.cloudflare.com https://www.youtube.com
style-src	'self' 'unsafe-inline' blob: fonts.googleapis.com/css tagmanager.google.com/
frame-ancestors	'self' https://wiseturkiye.com.tr https://microapps.google.com https://microapps-prod-tt.sandbox.google.com
frame-src	youtube.com www.youtube.com www.youtube-nocookie.com https://vars.hotjar.com https://bid.g.doubleclick.net https://www.googletagmanager.com https://insight.adsrvr.org https://match.adsrvr.org https://wise.com https://wise-sandbox.com https://gtm.wise.com https://dev-wi.se https://decagon.ai https://transferwise.com https://wise.navattic.com https://js-eu1.hsforms.net https://forms-eu1.hsforms.com/ https://challenges.cloudflare.com https://feedback.wise.com
worker-src	'self' blob:
form-action	'self' https://forms-eu1.hsforms.com/
base-uri	'self'
script-src-attr	'none'
upgrade-insecure-requests	(empty)

Headers sent

Header	Value
strict-transport-security	max-age=31536000
x-content-type-options	nosniff
permissions-policy	ch-ua-model=("https://sdk-api-v1.singular.net"),ch-ua-platform-version=("https://sdk-api-v1.singular.net"),ch-ua-full-version-list=("https://sdk-api-v1.singular.net")
x-xss-protection	0
server	cloudflare
x-powered-by	Next.js

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan