CSP provides a standard method for website owners to declare approved origins of content that browsers should be allowed to load on that website
| Websites using header Content-Security-Policy | 4,683,798 |
| Percentage of websites that use Content-Security-Policy header | 4.71% |
| Total discovered header values | More than 10,000 |
| Header uses directives | Yes |
| Header values are unique or random | No |
| Most popular in the country |  US |
| Directive | Share | Websites count | Unique Values |
|---|---|---|---|
| upgrade-insecure-requests | 46.41% | 2,173,740 | 66 |
| block-all-mixed-content | 18.68% | 874,930 | 38 |
| frame-ancestors | <0.1% | 2,209 | 4 |
| default-src | <0.1% | 1,591 | 7 |
| base-uri | <0.1% | 323 | 2 |
| report-uri | <0.1% | 299 | 4 |
| sandbox | <0.1% | 238 | 2 |
| object-src | <0.1% | 231 | 3 |
| media-src | <0.1% | 146 | 1 |
| frame-src | <0.1% | 139 | 3 |
| child-src | <0.1% | 104 | 3 |
| script-src | <0.1% | 75 | 2 |
| worker-src | <0.1% | 69 | 2 |
| img-src | <0.1% | 50 | 2 |
| manifest-src | <0.1% | 43 | 1 |
| report-to | <0.1% | 41 | 2 |
| connect-src | <0.1% | 37 | 2 |
| form-action | <0.1% | 37 | 2 |
| plugin-types | <0.1% | 36 | 1 |
| style-src | <0.1% | 27 | 2 |
| trusted-types | <0.1% | 27 | 1 |
| font-src | <0.1% | 23 | 1 |
| prefetch-src | <0.1% | 23 | 1 |
| require-sri-for | <0.1% | 13 | 1 |
| require-trusted-types-for | <0.1% | 7 | 1 |
| script-src-attr | <0.1% | 6 | 1 |
| referrer | <0.1% | 5 | 1 |
| style-src-attr | <0.1% | 4 | 1 |
| style-src-elem | <0.1% | 2 | 1 |
 PayPal, category Payment, total 1,213,472 websites |
 AddThis, category Widgets, total 646,153 websites |
 Tealium, category Tag Managers, total 43,590 websites |
 Algolia, category Widgets, total 37,228 websites |
 Heap, category Analytics, total 27,538 websites |
 Drift, category Live Chat, total 20,790 websites |
 Contentful, category Content Management System, total 14,905 websites |
 RapidSec, category Security Solutions, total 254 websites |
 Acquia Content Hub, category Miscellaneous, total 2 websites |
| Top 10k sites | 2,222 websites |
| Top 100k sites | 16,454 websites |
| Top 1m sites | 124,289 websites |
| Domain | Country | Rank | Contacts |
|---|---|---|---|
| US | 2 | ||
| US | 7 | ||
| US | 9 | ||
| US | 9 | ||
| US | 11 | ||
| US | 12 |
| Header value | Value prevalence |
|---|---|
| upgrade-insecure-requests | 18.54% |
| block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; | 17.06% |
| frame-ancestors 'self' | 12.82% |
| upgrade-insecure-requests; | 7.44% |
| frame-ancestors 'self' godaddy.com test-godaddy.com dev-godaddy.com *.godaddy.com *.test-godaddy.com *.dev-godaddy.com | 6.81% |
| frame-ancestors 'none'; | 2.33% |
| frame-ancestors https://*.ionos.com https://*.ionos.at https://*.ionos.co.uk https://*.ionos.de https://*.ionos.es https://*.ionos.fr https://*.ionos.it https://*.ionos.ca https://*.ionos.mx https://*.ionos.us https://*.website-editor.net https://*.mywebs | 1.49% |
| report-to network-errors | 1.32% |
| frame-ancestors 'self'; | 1.32% |
| upgrade-insecure-requests; default-src https: data:; script-src https: data: 'unsafe-inline' 'unsafe-eval'; style-src https: blob: 'unsafe-inline'; | 0.89% |
| default-src * data: blob: 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.jimdo.com jimdo.com; worker-src blob: | 0.60% |
| frame-ancestors 'none' | 0.58% |
| frame-ancestors 'self' websitebuilder.godaddy.com websitebuilder.secureserver.net | 0.49% |
| block-all-mixed-content | 0.47% |
| default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self' | 0.45% |
| script-src 'self' | 0.44% |
| frame-ancestors https://manage.menufy.com https://manager.menufy.com | 0.42% |
| default-src * data: 'unsafe-eval' 'unsafe-inline' | 0.35% |
| default-src https: data: 'unsafe-inline' 'unsafe-eval' | 0.35% |
| default-src 'self' 'unsafe-inline' | 0.30% |