www.chicagoprivatetoursandproductions.com

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Evidence and check scope

Configured:

No

Response inspected:

Homepage HTML response

Host requested:

www.chicagoprivatetoursandproductions.com

Host observed:

chicagoprivatetoursandproductions.com

References

Why it matters

A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.

What to do

After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.

Why it matters

Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.

What to do

Set frame-ancestors in CSP to the required trusted sites, and keep X-Frame-Options for older browsers when appropriate.