fscs.org.uk

HTML metadata

Title: Financial Services Compensation Scheme | FSCS
Description: FSCS protects customers when authorised financial services firms fail. You could be entitled to compensation of up to £120,000 and our service is free.
Language: en
Canonical: https://www.fscs.org.uk/

Open Graph

url: https://www.fscs.org.uk/
title: Home
site name: Financial Services Compensation Scheme Ltd.
description: FSCS protects customers when authorised financial services firms fail. You could be entitled to compensation of up to £120,000 and our service is free.

Technology

CDN: Azure Front Door

Analytics

Google Tag Manager

Cookie consent

Cookiebot

Third-party hosts loaded (4)

cdn.synthetix.com×1
cdnjs.cloudflare.com×1
consent.cookiebot.com×1
www.googletagmanager.com×1

Social

Registration

Registrar

123-Reg Limited t/a 123-reg

Created

2000-11-30

Expires

2026-11-30 194 days left

Updated

2024-09-01

Name servers

ns0.fscs.org.uk.
ns1.fscs.org.uk.

DNS records live

NS

ns0.fscs.org.uk
ns1.fscs.org.uk

MX

0 fscs-org-uk.mail.protection.outlook.com

TXT

8CA1731EDE9AF62EA268BB0E9FEC1EBD11EEB808A6C5348D6360B4916E5B2732
openai-domain-verification=dv-YkTz55PvteNeeEFrBwxpLKRE

Email authentication strong

SPF

v=spf1 ip4:91.103.171.22 ip4:91.103.169.151 ip4:20.90.171.247 ip4:51.137.132.238 ip4:20.90.171.245 ip4:20.90.171.246 ip4:89.16.167.250 ip4:147.160.167.0/26 ip4:23.21.109.197 ip4:23.21.109.212 ip4:52.49.201.246 ip4:52.49.235.189 include:spf.protection.outlook.com include:euro.confirmit.com include:_spf.psm.knowbe4.com ~all

softfail (~all)

DMARC

v=DMARC1; p=reject; pct=100; ruf=mailto:soc@fscs.org.uk

policy: reject (enforced)

DKIM

selector1: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFH4wrVM4PgPtlenJGR9WSE5YnL1VOo5t/QyvxVbhJyuvUnIUURfA9muYEgIMGsxv8rPg4EVtEBpXA3C+I1o…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvqtgYa9CtiDp+38LOfRkFzcAdH8P4C0BK40YNqaI7elO8dMgjUHrdsXIFFBVgUjuUTiKZdg1bfRt2Ic0O0…
s2: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnuLo9UoBqzFLmT+XpPMIFBjqz5svEzvZnv1grv+ybGsb7Y6gPI/SvCFsXch+ge7XHZq6rcWrOmQjHXk7/…

selectors probed

Certificate (current)

DigiCert Global G2 TLS RSA SHA256 2020 CA1

from 2025-09-03 to 2026-09-25

Expires in 128 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.fscs.org.uk/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: SameOrigin
x-content-type-options: nosniff
content-security-policy: default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.aspnetcdn.com cdnjs.cloudflare.com *.doubleclick.net static.doubleclick.net *.ytimg.com maps.google.com *.googleapis.com maps.gstatic.com googleads.g.doubleclick.net stats.g.doubleclick.net tagmanager.google.com www.google.com www.google.co.uk www.googletagmanager.com www.google-analytics.com *.google-analytics.com www.gstatic.com www.youtube.com *.googlesyndication.com *.googleadservices.com code.jquery.com pixel.quantserve.com rules.quantcount.com secure.quantserve.com *.syn-finity.com syn-document-manager.s3.amazonaws.com static-pages.s3.amazonaws.com cdn.synthetix.com synthetix.net www.synthetix.net wss://*.hotjar.com *.hotjar.com *.hotjar.io *.vimeo.com *.acast.com polyfill.io *.cookiebot.com *.networxrecruitment.com *.proofpoint.com *.monitor.azure.com *.samba.tv;object-src 'none';style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com *.ytimg.com *.google.com *.googleapis.com cdn.synthetix.com fscs.syn-finity.
strict-transport-security: max-age=31536000; includeSubDomains; preload