Sign in
Please enter your credentials to continue
✅ Form hijack blocked. CSP's
form-action 'self'
directive prevented the form from submitting to evil-cyber-hacker.com.
The violation was reported to Report URI.
CSP header sent with this page
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; form-action 'self'; report-uri https://helios.report-uri.com/r/t/csp/enforce; report-to default
What CSP did
form-action 'self' restricts where forms on the page are allowed to submit.
Even though the form's action attribute points to the attacker's server, the
browser refuses to send the POST request and fires a CSP violation report instead.