ft.com

https://www.ft.com/ · status 403 · checked 5/14/2026, 11:57:06 PM · 65ms

followed 1 redirect: 301 ft.com/ → 403 www.ft.com/ → 403

Functional. A few headers missing or weak.

Warnings

No Content-Security-Policy. The biggest single XSS mitigation is missing.

Strict-Transport-Security

preload listedgood

max-age: 63072000
includeSubDomains: yes
preload: yes

max-age=63072000; includeSubDomains; preload

Domain is on the HSTS preload list (via ft.com).

Content-Security-Policy

missing

Content-Security-Policy header is not set.

X-Frame-Options

good

SAMEORIGIN

X-Content-Type-Options

good

nosniff

Referrer-Policy

good

strict-origin-when-cross-origin

Permissions-Policy

good

accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=(self)

Cross-Origin-Opener-Policy

good

same-origin

Cross-Origin-Embedder-Policy

good

require-corp

Cross-Origin-Resource-Policy

good

same-origin

Server disclosure

Server: cloudflare
X-Powered-By: (not exposed)

Recommendations

Start with a tight CSP, e.g. default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'. Iterate from there.

Auto-fix: copy these headers into your server config

add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
# Tight starting policy. Iterate by inspecting CSP-Report-Only violations on a staging branch first.

Add inside the server { ... } block (or location / for path-scoped).
Reload with `nginx -s reload` after editing. Use `always` so headers are sent on error responses too.

AI-assisted remediation

Want a tailored fix plan in plain English?

Wiredepth Pro sends this report to our AI engine and streams back a 30-day rollout plan tailored to ft.com, with provider-specific tips when we can infer them from the data. 10 playbooks per month on Pro, 100 on MSP.

ProSee Pro plans→

Check another domain

Or share this URL with the team that owns the records.