Domain History

bitwarden.com

Grade C · 65/100 · 6/7 security headers present

Security Score

65/ 100

Security Headers

6/ 7

CSP Violations

NoViolations

Issues Found

14Issues

Recommendations

1Available

Security

65 / 100

Moderate security gaps found — unsafe directives or weak source restrictions.

Compliance

90 / 100

CSP implementation follows recommended standards and specifications.

Best Practices

60 / 100

Basic practices followed but missing important optimizations.

CSP Analysis

Content Security PolicyHIGH

default-src 'self';base-uri 'self';child-src blob:;connect-src 'self' wss: https: https://*.algolia.net https://*.algolianet.com https://insights.algolia.io https://func.bitwarden.com https://status.bitwarden.com https://us-central1-adaptive-growth.cloudfunctions.net https://pdf-convert.bitwarden.com https://aorta.clickagy.com https://hemsync.clickagy.com https://ws.zoominfo.com https://bitwarden.freshsales.io https://stats.g.doubleclick.net https://www.google-analytics.com https://api.hubapi.com https://forms.hubspot.com https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://bat.bing.com https://cdn.linkedin.oribi.io https://i.clarity.ms https://scout.salesloft.com https://script.crazyegg.com https://global.ketchcdn.com/ https://cdn.ketchjs.com/ https://*.demandbase.com https://*.company-target.com https://browser-intake-us3-datadoghq.com;img-src 'self' data: https: https://*.algolia.net https://images.ctfassets.net https://res.cloudinary.com https://www.google.com https://www.google-analytics.com https://i.ytimg.com https://*.hsforms.com https://track.hubspot.com https://analytics.twitter.com https://t.co https://alb.reddit.com https://aorta.clickagy.com https://bat.bing.com https://i.vimeocdn.com https://id.rlcdn.com https://idsync.rlcdn.com https://insight.adsrvr.org https://px.ads.linkedin.com https://p.adsymptotic.com https://stags.bluekai.com https://ct.capterra.com https://*.demandbase.com https://*.company-target.com;font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net https://*.typekit.net;form-action https://forms.hsforms.com https://www.facebook.com;frame-ancestors https://app.contentful.com;frame-src https://app.hubspot.com https://start.bitwarden.com https://*.doubleclick.net https://boards.greenhouse.io https://*.company-target.com https://docs.google.com https://forms.hsforms.com https://player.vimeo.com https://preview.widgets.ninetailed.io/ https://us02web.zoom.us https://www.facebook.com/ https://www.googletagmanager.com https://www.youtube.com https://*.hs-sites.com https://global.ketchcdn.com https://cdn.ketchjs.com/ https://app.contentful.com https://job-boards.greenhouse.io https://hemsync.clickagy.com https://insight.adsrvr.org;manifest-src 'self';object-src 'none';script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://cdn.jsdelivr.net/ https://js.hs-analytics.net https://js.hs-banner.com https://js.hs-scripts.com https://js.hsadspixel.net https://js.hscollectedforms.net https://js.hsforms.net https://js.hubspot.com https://amplify.outbrain.com https://tr.outbrain.com https://wave.outbrain.com https://j.6sc.co https://tag.demandbase.com https://a.quora.com https://assets.freshsales.io https://bat.bing.com https://boards.greenhouse.io https://cdn.jsdelivr.net/npm/[email protected] https://cdn.pdst.fm https://global.ketchcdn.com https://cdn.ketchjs.com/ https://connect.facebook.net https://mountain.com https://*.mountain.com https://extend.vimeocdn.com https://googleads.g.doubleclick.net https://libraries.hund.io https://ml314.com https://*.ml314.com https://player.vimeo.com https://plausible.io https://script.crazyegg.com https://scout-cdn.salesloft.com https://snap.licdn.com https://static.ads-twitter.com https://static.xingcdn.com/xingtrk/index.js https://tag.clearbitscripts.com https://cdn.hubilo.com https://tags.clickagy.com https://js.usemessages.com https://ws.zoominfo.com https://www.clarity.ms https://scripts.clarity.ms https://www.googletagmanager.com https://www.google-analytics.com https://www.googleadservices.com https://www.redditstatic.com https://x.clearbitjs.com https://app.contentful.com https://tags.clickagy.com/ https://js.zi-scripts.com https://js.adsrvr.org/ https://*.demandbase.com https://*.company-target.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net https://libraries.hund.io https://global.ketchcdn.com https://cdn.ketchjs.com/ https://*.typekit.net;worker-src 'self' blob: https://global.ketchcdn.com https://cdn.ketchjs.com/

Directive Analysis

default-srcLOW

self

base-uriLOW

self

child-srcLOW

blob:

•Info: 'blob:' URI in child-src

connect-srcHIGH

self wss: https: https://*.algolia.net https://*.algolianet.com https://insights.algolia.io https://func.bitwarden.com https://status.bitwarden.com https://us-central1-adaptive-growth.cloudfunctions.net https://pdf-convert.bitwarden.com https://aorta.clickagy.com https://hemsync.clickagy.com https://ws.zoominfo.com https://bitwarden.freshsales.io https://stats.g.doubleclick.net https://www.google-analytics.com https://api.hubapi.com https://forms.hubspot.com https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://bat.bing.com https://cdn.linkedin.oribi.io https://i.clarity.ms https://scout.salesloft.com https://script.crazyegg.com https://global.ketchcdn.com/ https://cdn.ketchjs.com/ https://*.demandbase.com https://*.company-target.com https://browser-intake-us3-datadoghq.com

•CRITICAL: 'https:' in connect-src allows scripts from ANY HTTPS domain

img-srcHIGH

self data: https: https://*.algolia.net https://images.ctfassets.net https://res.cloudinary.com https://www.google.com https://www.google-analytics.com https://i.ytimg.com https://*.hsforms.com https://track.hubspot.com https://analytics.twitter.com https://t.co https://alb.reddit.com https://aorta.clickagy.com https://bat.bing.com https://i.vimeocdn.com https://id.rlcdn.com https://idsync.rlcdn.com https://insight.adsrvr.org https://px.ads.linkedin.com https://p.adsymptotic.com https://stags.bluekai.com https://ct.capterra.com https://*.demandbase.com https://*.company-target.com

•Info: 'data:' URI in img-src

•CRITICAL: 'https:' in img-src allows scripts from ANY HTTPS domain

font-srcLOW

self data: https://fonts.gstatic.com https://cdn.jsdelivr.net https://*.typekit.net

•Info: 'data:' URI in font-src

form-actionLOW

https://forms.hsforms.com https://www.facebook.com

frame-ancestorsLOW

https://app.contentful.com

frame-srcLOW

https://app.hubspot.com https://start.bitwarden.com https://*.doubleclick.net https://boards.greenhouse.io https://*.company-target.com https://docs.google.com https://forms.hsforms.com https://player.vimeo.com https://preview.widgets.ninetailed.io/ https://us02web.zoom.us https://www.facebook.com/ https://www.googletagmanager.com https://www.youtube.com https://*.hs-sites.com https://global.ketchcdn.com https://cdn.ketchjs.com/ https://app.contentful.com https://job-boards.greenhouse.io https://hemsync.clickagy.com https://insight.adsrvr.org

manifest-srcLOW

self

object-srcLOW

none

script-srcHIGH

self unsafe-eval unsafe-inline blob: https://cdn.jsdelivr.net/ https://js.hs-analytics.net https://js.hs-banner.com https://js.hs-scripts.com https://js.hsadspixel.net https://js.hscollectedforms.net https://js.hsforms.net https://js.hubspot.com https://amplify.outbrain.com https://tr.outbrain.com https://wave.outbrain.com https://j.6sc.co https://tag.demandbase.com https://a.quora.com https://assets.freshsales.io https://bat.bing.com https://boards.greenhouse.io https://cdn.jsdelivr.net/npm/[email protected] https://cdn.pdst.fm https://global.ketchcdn.com https://cdn.ketchjs.com/ https://connect.facebook.net https://mountain.com https://*.mountain.com https://extend.vimeocdn.com https://googleads.g.doubleclick.net https://libraries.hund.io https://ml314.com https://*.ml314.com https://player.vimeo.com https://plausible.io https://script.crazyegg.com https://scout-cdn.salesloft.com https://snap.licdn.com https://static.ads-twitter.com https://static.xingcdn.com/xingtrk/index.js https://tag.clearbitscripts.com https://cdn.hubilo.com https://tags.clickagy.com https://js.usemessages.com https://ws.zoominfo.com https://www.clarity.ms https://scripts.clarity.ms https://www.googletagmanager.com https://www.google-analytics.com https://www.googleadservices.com https://www.redditstatic.com https://x.clearbitjs.com https://app.contentful.com https://tags.clickagy.com/ https://js.zi-scripts.com https://js.adsrvr.org/ https://*.demandbase.com https://*.company-target.com

•Unsafe eval() execution allowed in script-src

•Unsafe inline execution allowed in script-src

•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobs

•HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src - Hosts npm packages including Angular which enables CSP bypass via JSONP

•No nonces or hashes used for script-src

⚠cdn.jsdelivr.net: Hosts npm packages including Angular which enables CSP bypass via JSONP

style-srcHIGH

self unsafe-inline https://fonts.googleapis.com https://cdn.jsdelivr.net https://libraries.hund.io https://global.ketchcdn.com https://cdn.ketchjs.com/ https://*.typekit.net

•Unsafe inline execution allowed in style-src

worker-srcMEDIUM

self blob: https://global.ketchcdn.com https://cdn.ketchjs.com/

•Info: 'blob:' URI in worker-src

•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob content

Security Headers

✗Cross-Origin-Opener-PolicyMissing

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

How to add it:

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;

apache

Header always set Cross-Origin-Opener-Policy "same-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"

✓Permissions-PolicyPresent

microphone=(), camera=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31557600

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on bitwarden.com.

Issues Found

•CRITICAL: 'https:' in connect-src allows scripts from ANY HTTPS domaincritical
•CRITICAL: 'https:' in img-src allows scripts from ANY HTTPS domaincritical
•HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src - Hosts npm packages including Angular which enables CSP bypass via JSONPhigh
•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobshigh
•Info: 'blob:' URI in child-srcinfo
•Info: 'blob:' URI in worker-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Missing security header: Cross-Origin-Opener-Policymedium
•No nonces or hashes used for script-srcmedium
•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob contentmedium
•Unsafe eval() execution allowed in script-srchigh
•Unsafe inline execution allowed in script-srchigh
•Unsafe inline execution allowed in style-srchigh

Recommendations

→Consider implementing a stricter Content Security Policy

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about bitwarden.com

See full exposure report on OSN →Free, no signup.

bitwarden.com

1 scan since 7/18/2026

Latest: 65/100

Total Scans

Latest Score

65/100

First Scan

7/18/2026

Last Scan

7/18/2026

Security

65 / 100

Moderate security gaps found — unsafe directives or weak source restrictions.

Compliance

90 / 100

CSP implementation follows recommended standards and specifications.

Best Practices

60 / 100

Basic practices followed but missing important optimizations.

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 18, 2026	C (65)	Yes	6/7	14	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: C (65/100) for bitwarden.com

HTML

<a href="https://headertest.com/results/bitwarden.com" title="Security headers grade for bitwarden.com — HeaderTest">
  <img src="https://headertest.com/api/badge/bitwarden.com" alt="HeaderTest security grade: C (65/100) for bitwarden.com" />
</a>

Markdown

[![HeaderTest security grade: C (65/100) for bitwarden.com](https://headertest.com/api/badge/bitwarden.com)](https://headertest.com/results/bitwarden.com)