When Security Blocked Our Own Website

The idea

We wanted visitors to check their own websites without installing complicated software.

• Check security headers.
• Test HTTPS and encryption.
• Explore independent security testing services.
• Understand the results in plain English.

Nothing worked!

The page looked right, but none of the four testing buttons responded.

• First we suspected Safari was blocking new tabs.
• Changing the navigation method didn't help.
• We checked the live HTML and HTTP response headers.
• The real cause was our Content Security Policy (CSP).

The discovery

CyberCumbria's CSP included script-src 'self', which blocks inline JavaScript.

Our security settings were doing exactly what we'd configured them to do — protecting the site from unapproved scripts.

The fix

• Moved the JavaScript into a separate file hosted on CyberCumbria.
• Updated the page to load that file.
• Kept the existing CSP protection enabled.
• Retested all four buttons successfully.

The independent checks then returned several A+ grades for our website's security configuration.

One more lesson

When linking the new tool from the homepage, an overly broad HTML replacement accidentally changed the Privacy Online card instead.

We inspected the Git diff, identified the wrong change and corrected the exact card before committing.

What we learned

Don't disable a security control just because something stops working. Understand why it's blocking the behaviour first.

And always check your Git diff before saving changes!