www.cms.gov: Security & public interest — week 2026-W33
Security & public interest
Web-standards, metadata, and security checks in the spirit of ScanGov (methodology CC0), run across our scan rather than only the homepage.
Security & domain hygiene 6/8 on the origin
- ✓ Served over HTTPS https:: pass
- ✓ HTTP Strict Transport Security (HSTS): pass
- ✗ Content Security Policy (CSP): fail
- ✓ X-Content-Type-Options: nosniff: pass
- ✓ Clickjacking protection (X-Frame-Options or CSP frame-ancestors): pass
- ✓ Sponsored government TLD (.gov/.mil/.edu) gov: pass
- ✗ Published security.txt: fail
- ✓ Resolves with and without www cms.gov: pass
Public interest & sustainability signals origin-level checks