Domain History
www.github.com
Grade A · 88/100 · 5/7 security headers present
Security Score
A
88/ 100
Security Headers
5/ 7
CSP Violations
NoViolations
Issues Found
10Issues
Recommendations
3Available
Security
88 / 100Good security foundation but some CSP hardening recommended.
Compliance
77 / 100Mostly compliant but some directives or headers are missing.
Best Practices
53 / 100Basic practices followed but missing important optimizations.
CSP Analysis
Content Security PolicyHIGH
default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
Directive Analysis
default-srcLOW
none
base-uriLOW
self
child-srcLOW
github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
connect-srcHIGH
self uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com edge.fullstory.com rs.fullstory.com
•Subdomain wildcard '*.rel.tunnels.api.visualstudio.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.actions.githubusercontent.com' in connect-src - vulnerable to subdomain takeover
font-srcLOW
github.githubassets.com
form-actionLOW
self github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com
frame-ancestorsLOW
none
frame-srcLOW
viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com
img-srcMEDIUM
self data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/
•Info: 'data:' URI in img-src
•Info: 'blob:' URI in img-src
•Subdomain wildcard '*.githubusercontent.com' in img-src - vulnerable to subdomain takeover
manifest-srcLOW
self
media-srcLOW
github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/
script-srcMEDIUM
github.githubassets.com
•No nonces or hashes used for script-src
style-srcHIGH
unsafe-inline github.githubassets.com
•Unsafe inline execution allowed in style-src
upgrade-insecure-requestsLOW
worker-srcLOW
github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
Missing Directives
⚠HIGHMissing HIGH directive object-src (Plugin control - should be 'none')
Security Headers
✗Cross-Origin-Opener-PolicyMissing
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
nginx
add_header Cross-Origin-Opener-Policy "same-origin" always;apache
Header always set Cross-Origin-Opener-Policy "same-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
origin-when-cross-origin, strict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubdomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
deny
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
0
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
2 recommended security headers are missing on www.github.com.
Issues Found
- •Info: 'blob:' URI in img-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Missing HIGH directive object-src (Plugin control - should be 'none')high
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: Permissions-Policymedium
- •No nonces or hashes used for script-srcmedium
- •Subdomain wildcard '*.actions.githubusercontent.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.githubusercontent.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.rel.tunnels.api.visualstudio.com' in connect-src - vulnerable to subdomain takeovermedium
- •Unsafe inline execution allowed in style-srchigh
Recommendations
- →Add object-src directive with appropriate restrictions
- →Consider implementing a stricter Content Security Policy
- →Replace wildcards (*) with specific source lists
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about www.github.com
See full exposure report on OSN →Free, no signup.
www.github.com
3 scans since 8/2/2026
A
Latest: 88/100
Total Scans
3
Latest Score
88/100
First Scan
8/2/2026
Last Scan
8/2/2026
Security
88 / 100Good security foundation but some CSP hardening recommended.
Compliance
77 / 100Mostly compliant but some directives or headers are missing.
Best Practices
53 / 100Basic practices followed but missing important optimizations.
Score Trend
Security score progression over 3 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/www.github.com" title="Security headers grade for www.github.com — HeaderTest">
<img src="https://headertest.com/api/badge/www.github.com" alt="HeaderTest security grade: A (88/100) for www.github.com" />
</a>Markdown
[](https://headertest.com/results/www.github.com)