Content-Security_Policy

HTTP response header

Header usage statistics

Content-Security_Policy response header information and usage statistics.
Websites using header Content-Security_Policy35
Percentage of websites that use Content-Security_Policy header<0.1%
Total discovered header values20
Header uses directivesNo
Header values are unique or randomNo
Most popular in the country United States

Content-Security_Policy Directives

Content-Security_Policy directives value information and usage statistics
DirectiveShareWebsites countUnique Values

Content-Security_Policy header usage distribution by website rank



Geographical Distribution

Header usage distribution by websites across the globe.



Websites utilizing Content-Security_Policy

List of websites that use Content-Security_Policy header
DomainCountryRankContacts
www.visitaruba.com United States312,764
www.ucentral.cl Chile420,755
www.uniqa.hu Hungary485,629
derrick.com United States1,178,075
www.100bestwebhosts.com United States2,236,739
hslvizag.in India2,869,300
See full domain list

Common header values

List of top common Content-Security_Policy header values
Header valueValue prevalence
default-src 'self';17.14%
default-src *17.14%
frame-ancestors 'none'; block-all-mixed-content; default-src 'self' https://xtra-mile.co/; script-src 'self' https://*.googletagmanager.com/ https://googleads.g.doubleclick.net/ https://*.google.com/ https://snap.licdn.com/ https://connect.facebook.net/ h8.57%
default-src 'none';script-src 'self' www.google-analytics.com ajax.googleapis.com;connect-src 'self';img-src 'self';style-src 'self';base-uri 'self';form-action 'self';5.71%
default-src https:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'5.71%
script-src 'self' https://www.google.com5.71%
block-all-mixed-content;2.86%
default-src 'none'; connect-src 'self'; img-src 'self' https://ajax.googleapis.com https://www.google-analytics.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js https://ajax.googleapis.com/ajax/libs/j2.86%
default-src 'none'; script-src 'self' www.google-analytics.com www.googletagmanager.com; connect-src 'self'; img-src 'self' data:; font-src 'self' fonts.gstatic.com; style-src 'self' fonts.googleapis.com maxcdn.bootstrapcdn.com;2.86%
default-src 'none'; script-src 'self' www.google-analytics.com www.googletagmanager.com; connect-src 'self'; img-src 'self'; font-src 'self' fonts.gstatic.com; style-src 'self' fonts.googleapis.com maxcdn.bootstrapcdn.com; object-src 'self' *.uniqa.hu; fr2.86%
default-src 'none'; script-src'self' 'unsafe-inline' 'unsafe-eval' *.facebook.net www.google-analytics.com www.googletagmanager.com *.googleapis.com *.google.com *.gstatic.com *.cookiebot.com *.adobe.com *.adobe.io; script-src-elem 'self' 'unsafe-inline' 2.86%
default-src 'none'; script-src'self'www.google-analytics.com www.googletagmanager.com; connect-src 'self'; img-src 'self' data:; font-src'self' fonts.gstatic.com; style-src 'self' fonts.googleapis.com maxcdn.bootstrapcdn.com;2.86%
default-src 'self'; script-src 'self';font-src 'self';img-src *2.86%
default-src 'self'; upgrade-insecure-requests;2.86%
default-src-https: data: 'unsafe-inline' 'unsafe-eval'2.86%
frame-ancestors 'self' 'https://vantage*.crst.com' 'http://10.2.0.113:*';2.86%
frame-ancestors https://derrick.com2.86%
script-src * 'unsafe-inline' 'unsafe-eval'; object-src *; style-src * 'unsafe-inline'; img-src * data:; media-src *; frame-src *; frame-ancestors *; child-src * blob:; font-src *; connect-src *; report-uri /report-csp-violation2.86%
upgrade-insecure-requests2.86%
upgrade-insecure-requests;2.86%