www.ceda.berkeley.edu

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Evidence and check scope

Configured:

Yes

Number of policies:

1

Weak settings found:

Missing Script Or Default Source

Response inspected:

Homepage HTML response

Host requested:

www.ceda.berkeley.edu

Host observed:

populationsciences.berkeley.edu

References

Why it matters

A certificate works only between its start and expiry dates. An expired, not-yet-valid, or soon-to-expire certificate can trigger browser warnings and interrupt access to the website or API.

What to do

Use automatic renewal, monitor renewal failures, and alert the responsible team well before expiry.

Why it matters

Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.

What to do

Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.