Domain History

altodev2.drache-kokosnuss.de

Grade B · 75/100 · 7/7 security headers present

Security Score

75/ 100

Security Headers

7/ 7

CSP Violations

NoViolations

Issues Found

10Issues

Recommendations

2Available

Security

75 / 100

Good security foundation but some CSP hardening recommended.

Compliance

100 / 100

CSP implementation follows recommended standards and specifications.

Best Practices

35 / 100

Few best practices adopted — significant room for improvement.

CSP Analysis

Content Security PolicyHIGH

default-src https://penguin.epccm19.com;base-uri 'self';child-src 'self' www.youtube.com www.youtube-nocookie.com;connect-src 'self' https://penguin.epccm19.com https://stats.g.doubleclick.net https://www.facebook.com https://*.google.com https://adservice.google.com https://www.google-analytics.com https://www.googletagmanager.com https://ct.pinterest.com www.taboola.com;font-src 'self' data:;form-action 'self';frame-ancestors 'self';frame-src 'self' https://penguin.epccm19.com https://ct.pinterest.com https://www.youtube-nocookie.com  https://www.googletagmanager.com;img-src 'self' blob: data: https://cx.atdmt.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.facebook.com https://connect.facebook.net https://www.google.at https://www.google.com.au https://www.google.be https://www.google.com.br https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.com https://adservice.google.com https://translate.google.com https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.com.eg https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.co.in https://www.google.it https://www.google.co.jp https://www.google.co.kr https://www.google.lu https://www.google.lv https://www.google.me https://www.google.com.na https://www.google.nl https://www.google.no https://www.google.pt https://www.google.com.py https://www.google.se https://www.google.co.th https://www.google.com.tr https://www.google.com.tw https://www.google.co.uk https://www.google.co.zm https://www.google-analytics.com https://translate.googleapis.com https://www.googletagmanager.com https://www.gstatic.com https://tr.outbrain.com https://*.penguin.de https://*.penguinrandomhouse.de https://*.pinterest.com https://*.randomhouse.de https://i.ytimg.com;manifest-src 'self';media-src 'self' data: www.youtube.com www.youtube-nocookie.com;object-src 'self' *.googlevideo.com *.ytimg.com www.youtube.com www.youtube-nocookie.com;script-src 'self' 'unsafe-inline' https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com;script-src-elem 'self' 'unsafe-inline' https://penguin.epccm19.com https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com;style-src 'self' 'unsafe-inline' https://penguin.epccm19.com https://www.gstatic.com;worker-src https://www.googletagmanager.com

Directive Analysis

default-srcLOW

https://penguin.epccm19.com

base-uriLOW

self

child-srcLOW

self www.youtube.com www.youtube-nocookie.com

connect-srcLOW

self https://penguin.epccm19.com https://stats.g.doubleclick.net https://www.facebook.com https://*.google.com https://adservice.google.com https://www.google-analytics.com https://www.googletagmanager.com https://ct.pinterest.com www.taboola.com

font-srcLOW

self data:

•Info: 'data:' URI in font-src

form-actionLOW

self

frame-ancestorsLOW

self

frame-srcLOW

self https://penguin.epccm19.com https://ct.pinterest.com https://www.youtube-nocookie.com https://www.googletagmanager.com

img-srcLOW

self blob: data: https://cx.atdmt.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.facebook.com https://connect.facebook.net https://www.google.at https://www.google.com.au https://www.google.be https://www.google.com.br https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.com https://adservice.google.com https://translate.google.com https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.com.eg https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.co.in https://www.google.it https://www.google.co.jp https://www.google.co.kr https://www.google.lu https://www.google.lv https://www.google.me https://www.google.com.na https://www.google.nl https://www.google.no https://www.google.pt https://www.google.com.py https://www.google.se https://www.google.co.th https://www.google.com.tr https://www.google.com.tw https://www.google.co.uk https://www.google.co.zm https://www.google-analytics.com https://translate.googleapis.com https://www.googletagmanager.com https://www.gstatic.com https://tr.outbrain.com https://*.penguin.de https://*.penguinrandomhouse.de https://*.pinterest.com https://*.randomhouse.de https://i.ytimg.com

•Info: 'blob:' URI in img-src

•Info: 'data:' URI in img-src

manifest-srcLOW

self

media-srcLOW

self data: www.youtube.com www.youtube-nocookie.com

•Info: 'data:' URI in media-src

object-srcHIGH

self *.googlevideo.com *.ytimg.com www.youtube.com www.youtube-nocookie.com

•Subdomain wildcard '*.googlevideo.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ytimg.com' in object-src - vulnerable to subdomain takeover

script-srcHIGH

self unsafe-inline https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com

•Unsafe inline execution allowed in script-src

•No nonces or hashes used for script-src

script-src-elemHIGH

self unsafe-inline https://penguin.epccm19.com https://connect.facebook.net www.google.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://*.outbrain.com https://*.randomhouse.de https://penguinrandomhouse.de https://*.penguinrandomhouse.de https://s.pinimg.com https://*.pinterest.com https://*.taboola.com

•Unsafe inline execution allowed in script-src-elem

style-srcHIGH

self unsafe-inline https://penguin.epccm19.com https://www.gstatic.com

•Unsafe inline execution allowed in style-src

worker-srcLOW

https://www.googletagmanager.com

Security Headers

✓Cross-Origin-Opener-PolicyPresent

same-origin

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

✓Permissions-PolicyPresent

accelerometer=("https://www.obere-lutter.de/"), autoplay=(), camera=(), clipboard-write=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=("https://www.obere-lutter.de/"), magnetometer=("https://www.obere-lutter.de/"), midi=(), microphone=(), payment=(), picture-in-picture=(), sync-xhr=("https://www.obere-lutter.de/"), usb=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

Issues Found

•Info: 'blob:' URI in img-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Info: 'data:' URI in media-srcinfo
•No nonces or hashes used for script-srcmedium
•Subdomain wildcard '*.googlevideo.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ytimg.com' in object-src - vulnerable to subdomain takeovermedium
•Unsafe inline execution allowed in script-srchigh
•Unsafe inline execution allowed in script-src-elemhigh
•Unsafe inline execution allowed in style-srchigh

Recommendations

→Consider implementing a stricter Content Security Policy
→Replace wildcards (*) with specific source lists

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about altodev2.drache-kokosnuss.de

See full exposure report on OSN →Free, no signup.