Website check
coinbase.com
https://coinbase.com/Checked
A+
97/100
In plain English
coinbase.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
1 low
Low
Content Security Policy allows unsafe scripts
The policy allows inline or eval'd scripts, which removes most of its protection against injected code.
How to fix: Move inline scripts into files or give them nonces or hashes, then drop 'unsafe-inline' and 'unsafe-eval'.
script rules include 'unsafe-eval'
Technical details (30)
- ip
- 2a06:98c1:310d::6812:230f
- caa
- 0 issue "pki.goog; cansignhttpexchanges=yes", 0 issue "digicert.com", 0 issue "amazonaws.com", 0 iodef "mailto:security@coinbase.com", 0 issue "letsencrypt.org"
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Google Trust Services
- tls subject
- coinbase.com
- tls validTo
- 2026-12-11T05:58:45.000Z
- tls daysLeft
- 50
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 include:amazonses.com include:_spf.google.com -all
- email apex
- coinbase.com
- email dmarc
- v=DMARC1; p=reject; adkim=s; aspf=s; fo=1; rua=mailto:jpohmdhp@ag.dmarcian.com; ruf=mailto:jpohmdhp@fr.dmarcian.com;
- status
- 403
- cookies
- __cf_bm
- headers server
- cloudflare
- headers referrer-policy
- same-origin
- headers x-frame-options
- SAMEORIGIN
- headers permissions-policy
- accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s...
- headers x-content-type-options
- nosniff
- headers content-security-policy
- default-src 'none'; script-src 'nonce-7eJcdJfjVwlAW7f39nrojk' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge...
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.coinbase.com/
- requests
- 4
- timingMs
- 884
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- thirdPartyScripts
- 0
- thirdPartyScriptHosts
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.