Domain History

babycity.lt

Grade B · 70/100 · 5/6 security headers present

Security Score

70/ 100

Security Headers

5/ 6

CSP Violations

4Violations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src * 'unsafe-inline' 'unsafe-eval' data: blob: *.videoly.co *.youtube-nocookie.com *.youtube.com *.ytimg.com *.wistia.com *.wistia.net *.videoly.net *.twistoo.co; connect-src 'self' *.googletagmanager.com *.igodigital.com *.maxcdn.com *.polyfill.io *.facebook.net *.facebook.com *.searchnode.io *.omnisrc.com *.bitrec.io *.google.com *.google.ee *.google.fi *.google.lv *.google.lt *.google-analytics.com *.doubleclick.net *.soundestlink.com *.nr-data.net *.esto.ee *.hotjar.io *.cookieinformation.com *.searchnode.net *.bing.com *.googleapis.com *.googleadservices.com *.issuu.com *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.twistoo.co t.cometlytrack.com google.com *.nosto.com respondent.survicate.com survey.survicate.com survey-prd.survicate-cdn.com *.cookieyes.com cdn-cookieyes.com; font-src 'self' *.gstatic.com data: *.123formbuilder.com *.issuu.com *.bootstrapcdn.com *.twistoo.co surveys-static.survicate.com surveys-static-prd.survicate-cdn.com cdn.jsdelivr.net; frame-src 'self' *.123formbuilder.com *.facebook.com *.cookieinformation.com *.youtube.com *.youtube-nocookie.com *.issuu.com *.videoly.net *.cookiebot.com *.doubleclick.net *.flippingbook.com publuu.com googletagmanager.com *.google.com; img-src 'self' data: kotrynagroup.lt *.kotrynagroup.lt *.babycity.lt *.babycity.lv *.babycity.ee *.kidzone.lt *.kidzone.lv *.kidzone.ee *.kidzone.fi *.toycity.lt *.toycity.lv *.zaisluplaneta.lt *.jukukeskus.ee *.toysplanet.lv *.igodigital.com *.bing.com *.facebook.com *.google-analytics.com *.google.com *.google.lt *.google.lv *.google.ee *.google.fi *.ytimg.com *.videoly.co *.adnxs.com *.reddit.com *.googleapis.com *.gstatic.com *.youtube.com *.ckeditor.com *.doubleclick.net *.kotrynagroup.com *.googleadservices.com *.googletagmanager.com *.issuu.com *.wistia.com *.wistia.net *.cookiebot.com analytics.tiktok.com *.twistoo.co surveys-static.survicate.com surveys-static-prd.survicate-cdn.com assets.survicate.com img.survicate.com images.unsplash.com cdn-cookieyes.com; media-src *.twistoo.co data:; script-src 'self' 'unsafe-hashes' 'unsafe-eval' 'unsafe-inline' *.nr-data.net *.google.com *.google.lt *.google.lv *.google.fi *.google.ee *.igodigital.com polyfill.io *.bitrec.com *.googletagmanager.com *.facebook.net *.searchnode.io *.google-analytics.com *.doubleclick.net *.hotjar.com *.bing.com *.youtube.com omnisrc.com *.sentry-cdn.com *.soundestlink.com omnisnippet1.com *.doubleclick.net *.newrelic.com *.videoly.co *.123formbuilder.com *.esto.ee *.redditstatic.com *.cookieinformation.com *.adnxs.com *.googleapis.com *.ckeditor.com *.jsdelivr.net *.googleadservices.com *.issuu.com *.youtube-nocookie.com *.ytimg.com *.videoly.net *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.publuu.com cdnjs.cloudflare.com *.twistoo.co t.cometlytrack.com static.cloudflareinsights.com *.nosto.com nosto.stackla.com *.cloudfront.net survey.survicate.com surveys-static.survicate.com surveys-static-prd.survicate-cdn.com survey-prd.survicate-cdn.com cdn-cookieyes.com; style-src 'self' 'unsafe-inline' *.googleapis.com *.123formbuilder.com *.ckeditor.com *.jsdelivr.net *.issuu.com *.bootstrapcdn.com cdnjs.cloudflare.com *.twistoo.co *.cloudfront.net surveys-static.survicate.com surveys-static-prd.survicate-cdn.com

Directive Analysis

default-srcHIGH

blob: *.wistia.com 'unsafe-eval' *.videoly.net *.wistia.net 'unsafe-inline' *.twistoo.co data: *.ytimg.com *.youtube.com * *.videoly.co *.youtube-nocookie.com

•Unsafe eval() execution allowed in default-src

•Unsafe inline execution allowed in default-src

•Overly permissive wildcard (*) in default-src

•Missing recommended values for default-src: self

•Overly permissive default-src directive

connect-srcLOW

*.google-analytics.com *.googleapis.com survey-prd.survicate-cdn.com respondent.survicate.com google.com *.bitrec.io *.omnisrc.com *.searchnode.net *.doubleclick.net *.searchnode.io *.googleadservices.com cdn-cookieyes.com *.google.ee stape.io *.google.lt 'self' *.cookiebot.com *.facebook.com *.maxcdn.com *.esto.ee t.cometlytrack.com *.google.com *.issuu.com *.cookieyes.com *.facebook.net survey.survicate.com *.nosto.com *.google.fi *.googletagmanager.com *.hotjar.io *.bing.com *.igodigital.com capig.stape.host *.google.lv *.soundestlink.com *.cookieinformation.com *.twistoo.co analytics.tiktok.com *.polyfill.io *.nr-data.net

•Missing recommended values for connect-src: self

font-srcLOW

surveys-static-prd.survicate-cdn.com *.gstatic.com surveys-static.survicate.com *.issuu.com cdn.jsdelivr.net *.twistoo.co 'self' data: *.123formbuilder.com *.bootstrapcdn.com

•Missing recommended values for font-src: self

frame-srcLOW

googletagmanager.com *.google.com *.videoly.net *.issuu.com *.cookieinformation.com 'self' *.cookiebot.com *.facebook.com *.123formbuilder.com *.youtube.com publuu.com *.doubleclick.net *.flippingbook.com *.youtube-nocookie.com

•Missing recommended values for frame-src: self

img-srcLOW

*.google-analytics.com *.googleapis.com *.kotrynagroup.lt surveys-static-prd.survicate-cdn.com *.wistia.net *.ytimg.com *.doubleclick.net images.unsplash.com assets.survicate.com *.googleadservices.com cdn-cookieyes.com *.toycity.lv *.google.ee *.adnxs.com surveys-static.survicate.com *.kotrynagroup.com *.google.lt *.babycity.lv 'self' *.kidzone.ee *.facebook.com *.cookiebot.com *.kidzone.lt *.google.com *.wistia.com *.issuu.com kotrynagroup.lt *.babycity.lt data: *.toysplanet.lv *.google.fi *.googletagmanager.com *.bing.com *.google.lv *.toycity.lt *.gstatic.com *.kidzone.lv *.zaisluplaneta.lt *.kidzone.fi *.ckeditor.com img.survicate.com *.twistoo.co analytics.tiktok.com *.reddit.com *.babycity.ee *.youtube.com *.jukukeskus.ee *.igodigital.com *.videoly.co

•Missing recommended values for img-src: self

media-srcLOW

*.twistoo.co data:

•Missing recommended values for media-src: self

script-srcHIGH

*.google-analytics.com *.redditstatic.com *.googleapis.com surveys-static-prd.survicate-cdn.com survey-prd.survicate-cdn.com 'unsafe-eval' *.videoly.net *.ytimg.com *.doubleclick.net *.sentry-cdn.com *.cloudfront.net *.searchnode.io *.googleadservices.com *.youtube-nocookie.com *.bitrec.com *.publuu.com *.google.ee *.adnxs.com static.cloudflareinsights.com surveys-static.survicate.com *.newrelic.com stape.io *.google.lt 'self' *.cookiebot.com *.hotjar.com *.esto.ee t.cometlytrack.com *.google.com *.issuu.com *.facebook.net 'unsafe-inline' cdn-cookieyes.com *.123formbuilder.com survey.survicate.com *.nosto.com *.google.fi *.jsdelivr.net *.googletagmanager.com *.bing.com capig.stape.host *.google.lv nosto.stackla.com *.soundestlink.com *.ckeditor.com omnisrc.com omnisnippet1.com *.cookieinformation.com *.twistoo.co analytics.tiktok.com cdnjs.cloudflare.com *.youtube.com 'unsafe-hashes' polyfill.io *.igodigital.com *.videoly.co *.nr-data.net

•Unsafe eval() execution allowed in script-src

•Unsafe inline execution allowed in script-src

•Missing recommended values for script-src: sha512-, sha384-, nonce-, self, sha256-

•No nonces or hashes used for script-src

style-srcHIGH

surveys-static-prd.survicate-cdn.com *.googleapis.com surveys-static.survicate.com *.ckeditor.com *.issuu.com 'unsafe-inline' 'self' *.twistoo.co *.123formbuilder.com *.bootstrapcdn.com cdnjs.cloudflare.com *.jsdelivr.net *.cloudfront.net

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: sha512-, sha384-, nonce-, self, sha256-

Violations

•https://www.googletagmanager.com/gtag/js?id=AW-937270188&cx=c&gtm=45He57b1v811805774za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323~104909302~104909304 149 Refused to connect to 'https://pagead2.googlesyndication.com/ccm/collect?tid=AW-937270188&en=page_view&dl=https%3A%2F%2Fwww.babycity.lt%2Flt%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1545952223.1752593811&navt=n&npa=1&did=dY2Q2ZW&gdid=dY2Q2ZW&_tu=CA&gtm=45be57b1v9179631852z8811805774za200zb811805774&gcs=G100&gcd=13q3q3q3q5l1&dma_cps=-&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104630776~104630778~104684208~104684211~104732253~104732255~104908321~104908323~104909302~104909304&tft=1752593810720&tfd=2849&apve=1&apvf=f' because it violates the following Content Security Policy directive: "connect-src 'self' *.googletagmanager.com *.igodigital.com *.maxcdn.com *.polyfill.io *.facebook.net *.facebook.com *.searchnode.io *.omnisrc.com *.bitrec.io *.google.com *.google.ee *.google.fi *.google.lv *.google.lt *.google-analytics.com *.doubleclick.net *.soundestlink.com *.nr-data.net *.esto.ee *.hotjar.io *.cookieinformation.com *.searchnode.net *.bing.com *.googleapis.com *.googleadservices.com *.issuu.com *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.twistoo.co t.cometlytrack.com google.com *.nosto.com respondent.survicate.com survey.survicate.com survey-prd.survicate-cdn.com *.cookieyes.com cdn-cookieyes.com".

•https://www.babycity.lt/lt/ - Refused to load the image 'https://pagead2.googlesyndication.com/ccm/collect?tid=AW-937270188&en=page_view&dl=https%3A%2F%2Fwww.babycity.lt%2Flt%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1545952223.1752593811&navt=n&npa=1&did=dY2Q2ZW&gdid=dY2Q2ZW&_tu=CA&gtm=45be57b1v9179631852z8811805774za200zb811805774&gcs=G100&gcd=13q3q3q3q5l1&dma_cps=-&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104630776~104630778~104684208~104684211~104732253~104732255~104908321~104908323~104909302~104909304&tft=1752593810720&tfd=2849&apve=1&apvf=f&img=1' because it violates the following Content Security Policy directive: "img-src 'self' data: kotrynagroup.lt *.kotrynagroup.lt *.babycity.lt *.babycity.lv *.babycity.ee *.kidzone.lt *.kidzone.lv *.kidzone.ee *.kidzone.fi *.toycity.lt *.toycity.lv *.zaisluplaneta.lt *.jukukeskus.ee *.toysplanet.lv *.igodigital.com *.bing.com *.facebook.com *.google-analytics.com *.google.com *.google.lt *.google.lv *.google.ee *.google.fi *.ytimg.com *.videoly.co *.adnxs.com *.reddit.com *.googleapis.com *.gstatic.com *.youtube.com *.ckeditor.com *.doubleclick.net *.kotrynagroup.com *.googleadservices.com *.googletagmanager.com *.issuu.com *.wistia.com *.wistia.net *.cookiebot.com analytics.tiktok.com *.twistoo.co surveys-static.survicate.com surveys-static-prd.survicate-cdn.com assets.survicate.com img.survicate.com images.unsplash.com cdn-cookieyes.com".

•https://www.googletagmanager.com/ - Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' *.123formbuilder.com *.facebook.com *.cookieinformation.com *.youtube.com *.youtube-nocookie.com *.issuu.com *.videoly.net *.cookiebot.com *.doubleclick.net *.flippingbook.com publuu.com googletagmanager.com *.google.com".

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=15724800; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

sameorigin

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on babycity.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about babycity.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

babycity.lt

3 scans since 7/15/2025

Latest: 70/100

Total Scans

Latest Score

70/100

First Scan

7/15/2025

Last Scan

7/15/2025

Score Trend

Security score progression over 2 scans

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 15, 2025	B (70)	No	5/6	0	View →
Jul 15, 2025	A (80)	No	5/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for babycity.lt

HTML

<a href="https://headertest.com/results/babycity.lt" title="Security headers grade for babycity.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/babycity.lt" alt="HeaderTest security grade: B (70/100) for babycity.lt" />
</a>

Markdown

[![HeaderTest security grade: B (70/100) for babycity.lt](https://headertest.com/api/badge/babycity.lt)](https://headertest.com/results/babycity.lt)