Strange, I get the same thing too despite the domain being among those whitelisted. I don't know how 'self' cannot equal securityheaders.io for a request to that domain.

I remember a while back when I was first using this I had a really difficult time getting it to work for a site I was doing. In the end, I had to remove all references to 'self' as a source and use the domain instead (even though these should be one and the same).

Interesting, what version of Firefox is this? You can see in the CSP that 'self' is a defined keyword for both the script-src and style-src directives: https://report-uri.io/home/analyse/https%3A%2F%2Fsecurityhea...