www.grad.berkeley.edu

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Evidence and check scope

Configured:

No

Response inspected:

Homepage HTML response

Host requested:

www.grad.berkeley.edu

Host observed:

grad.berkeley.edu

References

Why it matters

Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.

What to do

Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.

Scope of this check

Why it matters

HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.

What to do

After confirming that every required page works over HTTPS, send the Strict-Transport-Security header on all HTTPS responses.

Scope of this check