F
zendesk.com
Score 5/100 · scanned 2026-08-04Content-Security-Policy
zendesk.com sends an enforcing CSP. It is allowlist-based.
default-src * wss://*.zopim.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.zendesk.com *.zendesk.co.jp *.zendesk.co.uk *.zendesk.com.br *.zendesk.com.mx *.zendesk.de *.zendesk.es *.zendesk.fr *.zendesk.kr *.zendesk.nl *.zendesk.tw *.zendesk.hk staging500.resultsbydesign.com zendesk.ddev.site; font-src * data:; img-src * blob: data:; media-src * blob:;worker-src 'self' blob:
| Directive | Sources |
|---|---|
default-src | * wss://*.zopim.com 'unsafe-inline' 'unsafe-eval' |
frame-ancestors | 'self' *.zendesk.com *.zendesk.co.jp *.zendesk.co.uk *.zendesk.com.br *.zendesk.com.mx *.zendesk.de *.zendesk.es *.zendesk.fr *.zendesk.kr *.zendesk.nl *.zendesk.tw *.zendesk.hk staging500.resultsbydesign.com zendesk.ddev.site |
font-src | * data: |
img-src | * blob: data: |
media-src | * blob: |
worker-src | 'self' blob: |
Headers sent
| Header | Value |
|---|---|
x-content-type-options | nosniff |
server | cloudflare |
Critical findings
script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.
script-src allows * — any host on the internet may serve executable script.Replace the wildcard with an explicit list, or a nonce with strict-dynamic.
No Strict-Transport-Security. A first visit over http, or any stripped link, can be intercepted before the redirect to https happens.Add: Strict-Transport-Security: max-age=31536000; includeSubDomains
Re-scan live
This is a snapshot from 2026-08-04. Check it now: