Domain History

altodev.drache-kokosnuss.de

Grade C · 65/100 · 6/7 security headers present

Security Score

65/ 100

Security Headers

6/ 7

CSP Violations

NoViolations

Issues Found

20Issues

Recommendations

2Available

Security

65 / 100

Moderate security gaps found — unsafe directives or weak source restrictions.

Compliance

90 / 100

CSP implementation follows recommended standards and specifications.

Best Practices

53 / 100

Basic practices followed but missing important optimizations.

CSP Analysis

Content Security PolicyHIGH

upgrade-insecure-requests; default-src 'none'; base-uri 'self'; child-src 'self' *.youtube.com *.youtube-nocookie.com; connect-src 'self' https://stats.g.doubleclick.net https://www.facebook.com https://*.google.com https://adservice.google.com https://www.google-analytics.com https://www.googletagmanager.com https://ct.pinterest.com *.taboola.com https://penguin.epccm19.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://ct.pinterest.com https://www.youtube-nocookie.com https://penguin.epccm19.com; frame-ancestors 'self'; img-src 'self' blob: data: https://cx.atdmt.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.facebook.com https://connect.facebook.net https://www.google.at https://www.google.com.au https://www.google.be https://www.google.com.br https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.com https://adservice.google.com https://translate.google.com https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.com.eg https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.co.in https://www.google.it https://www.google.co.jp https://www.google.co.kr https://www.google.lu https://www.google.lv https://www.google.me https://www.google.com.na https://www.google.nl https://www.google.no https://www.google.pt https://www.google.com.py https://www.google.se https://www.google.co.th https://www.google.com.tr https://www.google.com.tw https://www.google.co.uk https://www.google.co.zm https://www.google-analytics.com https://translate.googleapis.com https://www.googletagmanager.com https://www.gstatic.com https://tr.outbrain.com https://*.penguin.de https://*.penguinrandomhouse.de https://*.pinterest.com https://*.randomhouse.de https://i.ytimg.com; manifest-src 'self'; media-src 'self' data: *.youtube.com *.youtube-nocookie.com; object-src 'self' *.googlevideo.com *.ytimg.com *.youtube.com *.youtube-nocookie.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com https://penguin.epccm19.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com https://penguin.epccm19.com; worker-src none:

Directive Analysis

upgrade-insecure-requestsLOW

default-srcLOW

none

base-uriLOW

self

child-srcHIGH

self *.youtube.com *.youtube-nocookie.com

•Subdomain wildcard '*.youtube.com' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube-nocookie.com' in child-src - vulnerable to subdomain takeover

connect-srcMEDIUM

self https://stats.g.doubleclick.net https://www.facebook.com https://*.google.com https://adservice.google.com https://www.google-analytics.com https://www.googletagmanager.com https://ct.pinterest.com *.taboola.com https://penguin.epccm19.com

•Subdomain wildcard '*.taboola.com' in connect-src - vulnerable to subdomain takeover

font-srcLOW

self data:

•Info: 'data:' URI in font-src

form-actionLOW

self

frame-srcLOW

self https://ct.pinterest.com https://www.youtube-nocookie.com https://penguin.epccm19.com

frame-ancestorsLOW

self

img-srcLOW

self blob: data: https://cx.atdmt.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.facebook.com https://connect.facebook.net https://www.google.at https://www.google.com.au https://www.google.be https://www.google.com.br https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.com https://adservice.google.com https://translate.google.com https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.com.eg https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.co.in https://www.google.it https://www.google.co.jp https://www.google.co.kr https://www.google.lu https://www.google.lv https://www.google.me https://www.google.com.na https://www.google.nl https://www.google.no https://www.google.pt https://www.google.com.py https://www.google.se https://www.google.co.th https://www.google.com.tr https://www.google.com.tw https://www.google.co.uk https://www.google.co.zm https://www.google-analytics.com https://translate.googleapis.com https://www.googletagmanager.com https://www.gstatic.com https://tr.outbrain.com https://*.penguin.de https://*.penguinrandomhouse.de https://*.pinterest.com https://*.randomhouse.de https://i.ytimg.com

•Info: 'blob:' URI in img-src

•Info: 'data:' URI in img-src

manifest-srcLOW

self

media-srcHIGH

self data: *.youtube.com *.youtube-nocookie.com

•Info: 'data:' URI in media-src

•Subdomain wildcard '*.youtube.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube-nocookie.com' in media-src - vulnerable to subdomain takeover

object-srcHIGH

self *.googlevideo.com *.ytimg.com *.youtube.com *.youtube-nocookie.com

•Subdomain wildcard '*.googlevideo.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ytimg.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube-nocookie.com' in object-src - vulnerable to subdomain takeover

script-srcHIGH

self unsafe-inline unsafe-eval https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•No nonces or hashes used for script-src

script-src-elemHIGH

•Unsafe inline execution allowed in script-src-elem

•Unsafe eval() execution allowed in script-src-elem

style-srcHIGH

self unsafe-inline https://www.gstatic.com https://penguin.epccm19.com

•Unsafe inline execution allowed in style-src

worker-srcLOW

none:

Security Headers

✗Cross-Origin-Opener-PolicyMissing

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

How to add it:

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;

apache

Header always set Cross-Origin-Opener-Policy "same-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"

✓Permissions-PolicyPresent

accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), midi=(), microphone=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on altodev.drache-kokosnuss.de.

Issues Found

•Info: 'blob:' URI in img-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Info: 'data:' URI in media-srcinfo
•Missing security header: Cross-Origin-Opener-Policymedium
•No nonces or hashes used for script-srcmedium
•Subdomain wildcard '*.googlevideo.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.taboola.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube-nocookie.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube-nocookie.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube-nocookie.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ytimg.com' in object-src - vulnerable to subdomain takeovermedium
•Unsafe eval() execution allowed in script-srchigh
•Unsafe eval() execution allowed in script-src-elemhigh
•Unsafe inline execution allowed in script-srchigh
•Unsafe inline execution allowed in script-src-elemhigh
•Unsafe inline execution allowed in style-srchigh

Recommendations

→Consider implementing a stricter Content Security Policy
→Replace wildcards (*) with specific source lists

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about altodev.drache-kokosnuss.de

See full exposure report on OSN →Free, no signup.