nih.gov: Security & public interest — week 2026-W39

Security & public interest

Web-standards, metadata, and security checks in the spirit of ScanGov (methodology CC0), run across our scan rather than only the homepage.

Security & domain hygiene 5/8 on the origin

• ✓ Served over HTTPS https:: pass
• ✓ HTTP Strict Transport Security (HSTS): pass
• ✗ Content Security Policy (CSP): fail
• ✓ X-Content-Type-Options: nosniff: pass
• ✓ Clickjacking protection (X-Frame-Options or CSP frame-ancestors): pass
• ✓ Sponsored government TLD (.gov/.mil/.edu) gov: pass
• ✗ Published security.txt: fail
• ✗ Resolves with and without www www.nih.gov: fail