Strange, I get the same thing too despite the domain being among those whitelisted. I don&#x27;t know how &#x27;self&#x27; cannot equal securityheaders.io for a request to that domain.<p>I remember a while back when I was first using this I had a really difficult time getting it to work for a site I was doing. In the end, I had to remove all references to &#x27;self&#x27; as a source and use the domain instead (even though these should be one and the same).