Security Report Summary
A
Site: https://www.bentley.edu/
IP Address: 52.3.152.208
Report Time: 28 Oct 2026 12:34:33 UTC
Headers:
  • X-Content-Type-Options
  • X-Frame-Options
  • Content-Security-Policy
  • Strict-Transport-Security
  • Referrer-Policy
  • Permissions-Policy
Warning: Grade capped at A, please see warnings below.
Advanced:
Great grade! Perform a deeper security analysis of your website and APIs:
Missing Headers
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
Content-Security-PolicyThis policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive.
Raw Headers
HTTP/1.1200 OK
DateWed, 28 Oct 2026 12:34:33 GMT
Content-Typetext/html; charset=utf-8
Content-Length14135
Connectionkeep-alive
Set-Cookiesess_map=dxdarffwtveuzaaefrvzufvsscrqtbqfvbavqwevwbfsqzbxxaudfqqaeqeyaqqsfqcrabyaezeerxuxsaecazdebbfuzzxdstqrrvzwcerrzrdezuydyvqurqrcscuyrcxrxdswfssfybfxcwvbzttazstzfreautbxzwzbyestddxq; Path=/; HttpOnly; Secure;
Cache-Controlmax-age=2764800, public
X-Drupal-Dynamic-CacheHIT
Content-languageen
X-Content-Type-Optionsnosniff
X-Frame-OptionsSAMEORIGIN
ExpiresSun, 19 Nov 1978 05:00:00 GMT
VaryCookie,Accept-Encoding,User-Agent
X-GeneratorDrupal 11 (https://www.drupal.org)
Content-Security-Policyscript-src 'self' 'unsafe-inline' 'unsafe-eval' a.mailmunch.co ajax.googleapis.com applygrad.bentley.edu assets.calendly.com assets.juicer.io www.juicer.io bam-cell.nr-data.net bam.nr-data.net bat.bing.com careerinsight.burning-glass.com cdn.datatables.net cdn.jsdelivr.net cdn.unibuddy.co connect.facebook.net d.bablic.com dx.steelhousemedia.com e.infogram.com embed-cdn.flockler.com fast.fonts.net *.wistia.com fast.wistia.net fl-1.cdn.flockler.com js-agent.newrelic.com js.driftt.com js.hs-analytics.net js.hs-banner.com js.hs-scripts.com js.hsadspixel.net js.hscollectedforms.net js.hsforms.net js.hsleadflows.net js.usemessages.com mktdplp102cdn.azureedge.net mx.technolutions.net plugins.flockler.com public.tableau.com px.steelhousemedia.com s.yimg.com script.hotjar.com secure.wufoo.com static.wufoo.com siteimproveanalytics.com snap.licdn.com static.hotjar.com traffic-drivers.unibuddy.co ugadmission.bentley.edu us2-live.inside-graph.com us2-track.inside-graph.com weatherwidget.io ww.steelhousemedia.com www.buzzsprout.com www.eventbrite.com www.google-analytics.com www.google.com www.googleadservices.com www.googletagmanager.com cse.google.com www.youtube.com www.youvisit.com dx.mountain.com px.mountain.com insight.adsrvr.org slate-technolutions-net.cdn.technolutions.net fw.cdn.technolutions.net *.cdn.technolutions.net us2-cdn.inside-graph.com api.libanswers.com v2.libanswers.com askus.bentley.edu form.jotform.com form.jotform.us submit.jotform.us *.jotfor.ms cdn.weglot.com gs.mountain.com bentley.primo.exlibrisgroup.com www.instagram.com optimize.google.com *.flickr.com embedsocial.com js.hubspot.com marvel-b2-cdn.bc0a.com *.acquia.io sitegpt.ai *.sitegpt.ai *.termly.io community.bentley.edu cdn.mida.so cdn.deflect.co *.geniusplus.ai *.tiktokcdn-us.com assets.avatar.inside.chat chatbot.tassel.com whova.com d1keuthy5s86c8.cloudfront.net cdn.botpress.cloud files.bpcontent.cloud apis.google.com cdnjs.cloudflare.com https://assets.pinterest.com https://cdn.botframework.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://maxcdn.bootstrapcdn.com https://unpkg.com platform.instagram.com platform.twitter.com; script-src-attr 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline' a.mailmunch.co ajax.googleapis.com applygrad.bentley.edu assets.calendly.com assets.juicer.io www.juicer.io bam-cell.nr-data.net bam.nr-data.net bat.bing.com careerinsight.burning-glass.com cdn.datatables.net cdn.jsdelivr.net cdn.unibuddy.co connect.facebook.net d.bablic.com dx.steelhousemedia.com e.infogram.com embed-cdn.flockler.com fast.fonts.net *.wistia.com fast.wistia.net fl-1.cdn.flockler.com js-agent.newrelic.com js.driftt.com js.hs-analytics.net js.hs-banner.com js.hs-scripts.com js.hsadspixel.net js.hscollectedforms.net js.hsforms.net js.hsleadflows.net js.usemessages.com mktdplp102cdn.azureedge.net mx.technolutions.net plugins.flockler.com public.tableau.com px.steelhousemedia.com s.yimg.com script.hotjar.com secure.wufoo.com static.wufoo.com siteimproveanalytics.com snap.licdn.com static.hotjar.com traffic-drivers.unibuddy.co ugadmission.bentley.edu us2-live.inside-graph.com us2-track.inside-graph.com weatherwidget.io ww.steelhousemedia.com www.buzzsprout.com www.eventbrite.com www.google-analytics.com www.google.com www.googleadservices.com www.googletagmanager.com cse.google.com www.youtube.com www.youvisit.com dx.mountain.com px.mountain.com insight.adsrvr.org slate-technolutions-net.cdn.technolutions.net fw.cdn.technolutions.net *.cdn.technolutions.net us2-cdn.inside-graph.com api.libanswers.com v2.libanswers.com askus.bentley.edu form.jotform.com form.jotform.us submit.jotform.us *.jotfor.ms cdn.weglot.com googleads.g.doubleclick.net gs.mountain.com bentley.primo.exlibrisgroup.com www.instagram.com optimize.google.com *.google.com *.flickr.com embedsocial.com *.tiktok.com *.tiktokcdn-us.com js.hubspot.com marvel-b2-cdn.bc0a.com www.gstatic.com partner.googleadservices.com interfaces.zapier.com code.jquery.com *.acquia.io sitegpt.ai *.sitegpt.ai *.termly.io js.sentry-cdn.com community.bentley.edu cdn.mida.so cdn.deflect.co *.geniusplus.ai browser.sentry-cdn.com *.adtrafficquality.google assets.avatar.inside.chat chatbot.tassel.com whova.com d1keuthy5s86c8.cloudfront.net cdn.botpress.cloud files.bpcontent.cloud *.clarity.ms bzrcdn.openai.com openfpcdn.io static.hsappstatic.net apis.google.com cdnjs.cloudflare.com https://assets.pinterest.com https://cdn.botframework.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://maxcdn.bootstrapcdn.com https://unpkg.com platform.instagram.com platform.twitter.com; style-src 'self' 'unsafe-inline' a.mailmunch.co assets.juicer.io www.juicer.io cdn.datatables.net fast.fonts.net fl-1.cdn.flockler.com assets.calendly.com p.typekit.net use.typekit.net *.wistia.com slate-technolutions-net.cdn.technolutions.net fw.cdn.technolutions.net *.cdn.technolutions.net lf16-tiktok-web.ttwstatic.com www.google.com us2-cdn.inside-graph.com fonts.googleapis.com api.libanswers.com v2.libanswers.com askus.bentley.edu form.jotform.com form.jotform.us submit.jotform.us *.jotfor.ms cdn.weglot.com optimize.google.com embedsocial.com js.hubspot.com *.acquia.io applygrad.bentley.edu sitegpt.ai *.sitegpt.ai cdn.mida.so cdn.deflect.co *.geniusplus.ai *.tiktokcdn-us.com assets.avatar.inside.chat chatbot.tassel.com whova.com d1keuthy5s86c8.cloudfront.net cdn.botpress.cloud files.bpcontent.cloud https://cdnjs.cloudflare.com https://fonts.googleapis.com https://unpkg.com https://use.fontawesome.com; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' a.mailmunch.co assets.juicer.io www.juicer.io cdn.datatables.net fast.fonts.net fl-1.cdn.flockler.com assets.calendly.com p.typekit.net use.typekit.net *.wistia.com slate-technolutions-net.cdn.technolutions.net fw.cdn.technolutions.net *.cdn.technolutions.net lf16-tiktok-web.ttwstatic.com www.google.com us2-cdn.inside-graph.com api.libanswers.com v2.libanswers.com askus.bentley.edu form.jotform.com form.jotform.us submit.jotform.us *.jotfor.ms cdn.weglot.com fonts.googleapis.com www.instagram.com optimize.google.com embedsocial.com js.hubspot.com *.acquia.io applygrad.bentley.edu sitegpt.ai *.sitegpt.ai *.termly.io cdn.mida.so cdn.deflect.co *.geniusplus.ai *.tiktokcdn-us.com assets.avatar.inside.chat chatbot.tassel.com whova.com d1keuthy5s86c8.cloudfront.net cdn.botpress.cloud files.bpcontent.cloud https://cdnjs.cloudflare.com https://fonts.googleapis.com https://unpkg.com https://use.fontawesome.com; worker-src 'self' blob:; frame-ancestors 'self' e.issuu.com www.slideshare.net www.youtube-nocookie.com www.youtube.com app.myintuitionapp.org cdnapisec.kaltura.com fast.wistia.net forms.office.com maps.google.com player.vimeo.com *.vimeo.com teamup.com unibuddy.co w.soundcloud.com www.linkedin.com www.matchinggifts.com www.googletagmanager.com youtu.be bentleyu.wistia.com *.wistia.com *.kaltura.com plugins.flockler.com form.jotform.com form.jotform.us submit.jotform.us *.jotfor.ms cdn.weglot.com bentley.primo.exlibrisgroup.com www.instagram.com embedsocial.com js.hubspot.com cdn.forms.office.net *.imodules.com www.tours.vividmediany.com applygrad.bentley.edu sitegpt.ai *.sitegpt.ai *.termly.io cdn.mida.so cdn.deflect.co *.geniusplus.ai *.tiktokcdn-us.com assets.avatar.inside.chat chatbot.tassel.com whova.com d1keuthy5s86c8.cloudfront.net cdn.botpress.cloud files.bpcontent.cloud; report-uri https://bentleyu.report-uri.com/r/d/csp/enforce
Strict-Transport-Securitymax-age=31536000; includeSubDomains
Cross-Origin-Opener-Policysame-origin-allow-popups
Referrer-Policystrict-origin-when-cross-origin
Last-ModifiedWed, 28 Oct 2026 12:22:53 GMT
ETag"1793190173-gzip"
Content-Encodinggzip
X-Request-IDv-4c95905c-d2ca-11f1-addc-537dcbc3d63a
X-AH-Environmentprod
Age699
Viavarnish
X-CacheHIT
X-Cache-Hits151
Accept-Rangesbytes
X-MP-XAE28060
X-RCOR140c09cd2fcd6014458819c2ff800134
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
Set-CookieThere is no Cookie Prefix on this cookie. This is not a SameSite Cookie.
X-Content-Type-OptionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
X-Frame-OptionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail.
Strict-Transport-SecurityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.