aruodas.lt
Grade F · 0/100 · 5/7 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
Security
0 / 100Critical security vulnerabilities — CSP provides minimal protection.
Compliance
0 / 100Non-compliant — CSP implementation is incomplete or report-only.
Best Practices
0 / 100Best practices largely absent — review CSP configuration.
CSP Analysis
This site does not set a Content-Security-Policy HTTP header. Without CSP, browsers allow all inline scripts, eval(), and resources from any origin, leaving the site vulnerable to Cross-Site Scripting (XSS) attacks.
Security Headers
same-origin
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
same-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
How to add it:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on aruodas.lt.
Issues Found
- •No Content Security Policy (CSP) header detected - site is vulnerable to XSS attackscritical
- •Without CSP, browsers allow all inline scripts, eval(), and resources from any origincritical
- •Missing security header: X-XSS-Protectionmedium
- •Missing security header: Strict-Transport-Securitymedium
Recommendations
- →Implement a Content Security Policy header to protect against XSS and data injection attacks
- →Start with a report-only policy (Content-Security-Policy-Report-Only) to identify required resources before enforcing
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
aruodas.lt
4 scans since 7/15/2025
Latest: 0/100
Total Scans
4
Latest Score
0/100
First Scan
7/15/2025
Last Scan
7/8/2026
Security
0 / 100Critical security vulnerabilities — CSP provides minimal protection.
Compliance
0 / 100Non-compliant — CSP implementation is incomplete or report-only.
Best Practices
0 / 100Best practices largely absent — review CSP configuration.
Score Trend
Security score progression over 3 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/aruodas.lt" title="Security headers grade for aruodas.lt — HeaderTest">
<img src="https://headertest.com/api/badge/aruodas.lt" alt="HeaderTest security grade: F (0/100) for aruodas.lt" />
</a>[](https://headertest.com/results/aruodas.lt)