Content-Security-Policy

youtube.com sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

base-uri 'self';object-src 'none';script-src 'report-sample' 'nonce-jKIM0iDb5XWaWgxrYZP-xg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';report-uri https://csp.withgoogle.com/csp/youtube_main/strict, require-trusted-types-for 'script'

Directive	Sources
base-uri	'self'
object-src	'none'
script-src	'report-sample' 'nonce-jKIM0iDb5XWaWgxrYZP-xg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
report-uri	https://csp.withgoogle.com/csp/youtube_main/strict, require-trusted-types-for 'script'

Headers sent

Header	Value
strict-transport-security	max-age=31536000
x-frame-options	SAMEORIGIN
x-content-type-options	nosniff
permissions-policy	ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy	same-origin-allow-popups; report-to="youtube_main"
x-xss-protection	0
server	ESF

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan