1Password

Password manager with end-to-end encrypted vaults, browser autofill, passkey support and shared vaults for families and teams.

1password.com security headers B 75/100

password-managers · added 2026-09-30

Compare

Security headers: B, 75 out of 100

Number 34 of 95 in the ranking. Missing 4 of the 9 headers we check.

Meets the B minimum (70/100) in our RFP clause.

With these headers missing, 1password.com is more exposed to clickjacking.

Missing 4

Permissions-Policy 0 of 10

Switches off browser features the product does not use, such as camera, microphone, location and payments, for the page and anything embedded in it.

Without it: Any script or iframe on the page, including third-party ads and chat widgets, can ask the user for camera, microphone or location access under the vendor's name.
Cross-Origin-Opener-Policy 0 of 5

Cuts the link between the product's window and windows opened by, or opening, other sites.

Without it: A page that opens the product keeps a handle on its window and can later redirect it to a look-alike sign-in or payment page (tab-nabbing) while the user thinks they are still on the real site. It is also part of the isolation browsers need to defend against Spectre-style attacks.
Cross-Origin-Resource-Policy 0 of 5

Tells browsers which sites may load this site's resources.

Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.
No version disclosure 0 of 5

Keeps the Server and X-Powered-By headers from announcing exact software versions.

Without it: A header like "nginx/1.18.0" or "PHP/7.4" tells an attacker which known vulnerabilities to try, and flags possibly unpatched software to every automated scanner on the internet.

Sent 5

Content-Security-Policy 25 of 25

default-src 'none'; media-src 'self' https://videos.ctfassets.net:* https://assets.qualified.com https://js.qualified.com; script-src-elem 'self' 'nonce-467409c7-485a-47c4-9d04-054ffc887937' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js 'unsafe-hashes' 'sha256-cdFvGnPvdeavqCupE0X1iKxDb2jmBXXTGmE6AcHOk+c=' 'sha256-ep0lyBO1i+WpsX2W3CxFRXjI+Hxg1zdLj+K4nN4Yzdk=' 'sha256-4oZHWXlD1CxPvT8wgkm3WHUpJ/ywMPHPB88gaPqIWak=' 'sha256-013vXU/GPsW1pY4eYpRTI4yOUa7i0F3+gAeV8YiJeI8=' 'sha256-L+uPL9EFQ001JTBerq6Emgr+dGNFjYmEKsAiLjmZ8iU=' 'sha256-TS3QDaf5hBbxZ5c2CUOFJTHeI5BshT2SVba8ez1r6Rc=' 'sha256-wSGTrzhz6pfHVymBKpslj6dh0Yfw6FLQSU1tkScIdak='; script-src 'self' 'wasm-unsafe-eval' 'nonce-467409c7-485a-47c4-9d04-054ffc887937' https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/airgap.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/ui.js https://transcend-cdn.com/cm/fa619274-3c15-4155-bbec-c0cb75733259/xdi.js; style-src 'self' 'nonce-467409c7-485a-47c4-9d04-054ffc887937' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='; style-src-elem 'self' 'nonce-467409c7-485a-47c4-9d04-054ffc887937' https://transcend-cdn.com 'unsafe-hashes' 'sha256-oV3jdqk8GO/BUZSwos543OlGzhzxD3uMNE23EaxYMEQ=' 'sha256-/4tktfVAle+8ojynlFnhze1lbgwtFnndScvcHIucgqc=' 'sha256-zlqnbDt84zf1iSefLU/ImC54isoprH/MRiVZGskwexk=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-7JyL1A8Kywti3E1sWTTspFukJsEOqlNFJPIxVimWbAQ=' 'sha256-ctkCoEVA29++pFSHJTSibl/hZptNpNCnDIKVUoM0bkg='; style-src-attr 'unsafe-inline'; connect-src 'self' https://experience.ninetailed.co https://ingest.insights.ninetailed.co https://assets.ctfassets.net:* https://start.1password.com https://start.1password.ca https://start.1password.eu https://www.google-analytics.com https://us.app.unleash-hosted.com https://flow.1passwordservices.com https://integrations.1passwordservices.com https://telemetry.transcend.io/collect https://browser-intake-datadoghq.com https://sst.1passwordservices.com https://c.6sc.co https://ipv6.6sc.co https://b.6sc.co https://epsilon.6sense.com https://transcend-cdn.com https://1password.zendesk.com https://px.ads.linkedin.com https://px4.ads.linkedin.com https://www.facebook.com https://www.instagram.com https://pixel-config.reddit.com https://*.qualified.com wss://*.qualified.com https://googleads.g.doubleclick.net https://www.google.com; manifest-src 'self'; font-src 'self'; object-src 'self'; img-src 'self' blob: https://images.ctfassets.net:* https://www.google.com https://www.google.ad https://www.google.ae https://www.google.com.af https://www.google.com.ag https://www.google.al https://www.google.am https://www.google.co.ao https://www.google.com.ar https://www.google.as https://www.google.at https://www.google.com.au https://www.google.az https://www.google.ba https://www.google.com.bd https://www.google.be https://www.google.bf https://www.google.bg https://www.google.com.bh https://www.google.bi https://www.google.bj https://www.google.com.bn https://www.google.com.bo https://www.google.com.br https://www.google.bs https://www.google.bt https://www.google.co.bw https://www.google.by https://www.google.com.bz https://www.google.ca https://www.google.cd https://www.google.cf https://www.google.cg https://www.google.ch https://www.google.ci https://www.google.co.ck https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.com.co https://www.google.co.cr https://www.google.com.cu https://www.google.cv https://www.google.com.cy https://www.google.cz https://www.google.de https://www.google.dj https://www.google.dk https://www.google.dm https://www.google.com.do https://www.google.dz https://www.google.com.ec https://www.google.ee https://www.google.com.eg https://www.google.es https://www.google.com.et https://www.google.fi https://www.google.com.fj https://www.google.fm https://www.google.fr https://www.google.ga https://www.google.ge https://www.google.gg https://www.google.com.gh https://www.google.com.gi https://www.google.gl https://www.google.gm https://www.google.gr https://www.google.com.gt https://www.google.gy https://www.google.com.hk https://www.google.hn https://www.google.hr https://www.google.ht https://www.google.hu https://www.google.co.id https://www.google.ie https://www.google.co.il https://www.google.im https://www.google.co.in https://www.google.iq https://www.google.is https://www.google.it https://www.google.je https://www.google.com.jm https://www.google.jo https://www.google.co.jp https://www.google.co.ke https://www.google.com.kh https://www.google.ki https://www.google.kg https://www.google.co.kr https://www.google.com.kw https://www.google.kz https://www.google.la https://www.google.com.lb https://www.google.li https://www.google.lk https://www.google.co.ls https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.com.ly https://www.google.co.ma https://www.google.md https://www.google.me https://www.google.mg https://www.google.mk https://www.google.ml https://www.google.com.mm https://www.google.mn https://www.google.com.mt https://www.google.mu https://www.google.mv https://www.google.mw https://www.google.com.mx https://www.google.com.my https://www.google.co.mz https://www.google.com.na https://www.google.com.ng https://www.google.com.ni https://www.google.ne https://www.google.nl https://www.google.no https://www.google.com.np https://www.google.nr https://www.google.nu https://www.google.co.nz https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.pg https://www.google.com.ph https://www.google.com.pk https://www.google.pl https://www.google.pn https://www.google.com.pr https://www.google.ps https://www.google.pt https://www.google.com.py https://www.google.com.qa https://www.google.ro https://www.google.ru https://www.google.rw https://www.google.com.sa https://www.google.com.sb https://www.google.sc https://www.google.se https://www.google.com.sg https://www.google.sh https://www.google.si https://www.google.sk https://www.google.com.sl https://www.google.sn https://www.google.so https://www.google.sm https://www.google.sr https://www.google.st https://www.google.com.sv https://www.google.td https://www.google.tg https://www.google.co.th https://www.google.com.tj https://www.google.tl https://www.google.tm https://www.google.tn https://www.google.to https://www.google.com.tr https://www.google.tt https://www.google.com.tw https://www.google.co.tz https://www.google.com.ua https://www.google.co.ug https://www.google.co.uk https://www.google.com.uy https://www.google.co.uz https://www.google.com.vc https://www.google.co.ve https://www.google.co.vi https://www.google.com.vn https://www.google.vu https://www.google.ws https://www.google.rs https://www.google.co.za https://www.google.co.zm https://www.google.co.zw https://www.google.cat https://www.google-analytics.com https://sst.1passwordservices.com https://cm.g.doubleclick.net https://stats.g.doubleclick.net https://insight.adsrvr.org https://px.mountain.com https://b.6sc.co https://px.ads.linkedin.com/ https://px4.ads.linkedin.com/ https://www.facebook.com https://www.instagram.com https://alb.reddit.com https://messenger-assets.qualified.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com; child-src https://www.youtube-nocookie.com https://secure.livechatinc.com; frame-src https://www.youtube-nocookie.com https://www.youtube-nocookie.com/embed https://secure.livechatinc.com https://player.vimeo.com https://insight.adsrvr.org https://match.adsrvr.org https://sync-transcend-cdn.com https://www.figma.com https://app.getreprise.com/ https://player.simplecast.com https://integrations.1passwordservices.com; form-action 'self' https://start.1password.com https://flow.1passwordservices.com; frame-ancestors https://*.1passwordservices.com https://*.1password.com https://*.1password.ca https://*.1password.eu https://main.1pstage.com; report-uri https://csp.1passwordservices.com/report?tags=1pw_prd; report-to csp-endpoint
Strict-Transport-Security 20 of 20

max-age=31536000; includeSubdomains; preload
X-Content-Type-Options 10 of 10

nosniff
Frame protection 10 of 10

CSP frame-ancestors
Referrer-Policy 10 of 10

no-referrer-when-downgrade

Checked 2026-10-08 at https://1password.com/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.