It looks like they're also downloading images directly from your domain, I see https://www.saashub.com/images/app/service_logos/129/k2q4pxz97dmy/medium.png http

It looks like they're also downloading images directly from your domain, I see https://www.saashub.com/images/app/service_logos/129/k2q4pxz97dmy/medium.png https://www.saashub.com/images/app/service_logos/129/k2q4pxz... for example in my debugger. Edit: you could maybe add a <meta> tag to define a CSP in but I guess they will remove it [1]. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP