Domain History

babydo.lt

Grade B · 70/100 · 4/6 security headers present

Security Score

70/ 100

Security Headers

4/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src 'unsafe-eval' 'unsafe-inline' 'self' data: blob: maxcdn.bootstrapcdn.com region1.google-analytics.com *.soundestlink.com capi.babydo.lt *.stape.net www.googleadservices.com fonts.soundestlink.com forms.soundestlink.com formsv2.soundestlink.com wt.omnisendlink.com omnisnippet1.com *.omnisnippet1.com babydo.lv babydo.ee *.googletagmanager.com *.googleapis.com *.neopay.lt *.omnivasiunta.lt *.doubleclick.net https://www.google-analytics.com *.facebook.com *.facebook.net *.google.com *.google.ac *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.com.kh *.google.cc *.google.cd *.google.cf *.google.cat *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn g.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gf *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gp *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.iq *.google.ie *.google.co.il *.google.im *.google.co.in *.google.io *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.com.lc *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.ne *.google.com.nf *.google.com.ng *.google.com.ni *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pk *.google.com.pa *.google.com.pe *.google.com.ph *.google.pl *.google.com.pg *.google.pn *.google.co.pn *.google.com.pr *.google.ps *.google.pt *.google.com.p *.gstatic.com, style-src 'self' 'unsafe-inline' region1.google-analytics.com *.gstatic.com maxcdn.bootstrapcdn.com omnisnippet1.com *.omnisnippet1.com wt.omnisendlink.com fonts.soundestlink.com *.facebook.com *.facebook.net *.google.com *.google.ac *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.com.kh *.google.cc *.google.cd *.google.cf *.google.cat *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn g.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gf *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gp *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.iq *.google.ie *.google.co.il *.google.im *.google.co.in *.google.io *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.com.lc *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.ne *.google.com.nf *.google.com.ng *.google.com.ni *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pk *.google.com.pa *.google.com.pe *.google.com.ph *.google.pl *.google.com.pg *.google.pn *.google.co.pn *.google.com.pr *.google.ps *.google.pt *.google.com.p *.googleapis.com, script-src 'self' 'unsafe-inline' 'unsafe-eval' region1.google-analytics.com www.googleadservices.com forms.soundestlink.com omnisnippet1.com *.omnisnippet1.com wt.omnisendlink.com connect.facebook.net *.facebook.com facebook.net *.googleapis.com *.google.com *.google.ac *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.com.kh *.google.cc *.google.cd *.google.cf *.google.cat *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn g.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gf *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gp *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.iq *.google.ie *.google.co.il *.google.im *.google.co.in *.google.io *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.com.lc *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.ne *.google.com.nf *.google.com.ng *.google.com.ni *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pk *.google.com.pa *.google.com.pe *.google.com.ph *.google.pl *.google.com.pg *.google.pn *.google.co.pn *.google.com.pr *.google.ps *.google.pt *.google.com.p stats.g.doubleclick.net *.doubleclick.net *.google-analytics.com *.googletagmanager.com https://www.google-analytics.com *.gstatic.com;, img-src 'self' 'unsafe-inline' 'unsafe-eval' data: region1.google-analytics.com omnisnippet1.com *.omnisnippet1.com wt.omnisendlink.com babydo.lv babydo.ee *.soundestlink.com *.neopay.lt formsv2.soundestlink.com forms.soundestlink.com *.omnivasiunta.lt connect.facebook.net *.facebook.com facebook.net *.googleapis.com *.google.com *.google.ac *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.com.kh *.google.cc *.google.cd *.google.cf *.google.cat *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn g.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gf *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gp *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.iq *.google.ie *.google.co.il *.google.im *.google.co.in *.google.io *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.com.lc *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.ne *.google.com.nf *.google.com.ng *.google.com.ni *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pk *.google.com.pa *.google.com.pe *.google.com.ph *.google.pl *.google.com.pg *.google.pn *.google.co.pn *.google.com.pr *.google.ps *.google.pt *.google.com.p stats.g.doubleclick.net *.doubleclick.net *.google-analytics.com *.googletagmanager.com https://www.google-analytics.com *.gstatic.com;

Directive Analysis

default-srcHIGH

*.googleapis.com *.google.com.np *.google.cn *.google.cat *.google.com.nf *.google.com.bo *.google.com.pk *.google.gr *.google.bg *.doubleclick.net *.google.ge *.google.com.bz *.googleapis.com, *.google.co.in *.google.co.ke *.google.fr *.facebook.com *.google.com.mt *.google.gm *.neopay.lt *.google.cd *.google.de *.google.co.ma *.facebook.net 'unsafe-inline' *.google.com.my region1.google-analytics.com *.google.fi *.google.ml *.google.mu *.google.com.ng *.google.ms *.gstatic.com *.google.at *.omnisnippet1.com *.google.cm *.google.as *.google.ae *.google.ne *.google.hn *.google.bi *.google.com.gh babydo.ee *.google.ca *.google.lu *.google.je *.google.com.au wt.omnisendlink.com *.google.com.kw *.google.cz *.google.gl *.google.gy *.google.mw *.google.bj facebook.net *.stape.net *.google.com *.google.com.mm *.google.dk *.google.az *.google.nr formsv2.soundestlink.com *.google.bf *.google.cg *.google.com.gt *.google.com.af *.google.me *.google.ps *.google.fm *.google.com.pr *.google.cc *.google.com.ly *.google.com.ag *.google.al *.google.kg fonts.soundestlink.com *.google.pt *.google.com.ai *.google.bs *.google.com.bn capi.babydo.lt *.google.co.ls *.google.co.ck *.google.ie *.google.it *.google.com.do www.googleadservices.com *.google.com.gi *.google.co.cr style-src *.google.io *.google.ee maxcdn.bootstrapcdn.com *.google.be *.google.com.cy *.google.iq *.google.ad 'self' *.google.com.lc *.google.dm g.cn *.google.ga connect.facebook.net *.google.ac *.google.com.ni *.google.com.om *.google.am *.google.bt *.google.com.hk *.google.com.br *.google.la *.google.mn *.googletagmanager.com *.google.com.et *.google.com.p *.google.gf babydo.lv *.google.mk *.google.com.na *.google.nu *.google.co.ao *.gstatic.com, *.google.li *.google.cf *.google.com.eg *.google.hr *.google.com.ec *.google.cl *.google.dz *.google.gg *.google.com.pa *.google.co.kr *.google.com.ph *.google.kz *.google.pl *.google-analytics.com 'unsafe-eval' *.google.es *.google.dj *.google.mv *.google.co.mz stats.g.doubleclick.net *.google.com.fj *.google.com.lb *.google.co.nz *.google.com.pe *.google.im *.google.com.co forms.soundestlink.com *.google.com.bh *.google.co.id *.google.nl *.google.ci *.google.co.il https://www.google-analytics.com *.google.lt *.google.ba *.google.ki *.omnivasiunta.lt *.google.md *.google.co.jp *.google.lk *.google.com.pg *.google.com.kh *.google.ch *.google.jo *.google.hu *.google.mg *.google.gp *.google.com.mx *.google.com.bd data: *.google.no *.google.by *.google.com.ar blob: *.google.lv script-src *.soundestlink.com omnisnippet1.com *.google.co.bw *.google.ht *.google.co.pn *.google.com.cu *.google.cv *.google.com.jm *.google.pn *.google.is

•Unsafe inline execution allowed in default-src

•Unsafe eval() execution allowed in default-src

•Missing recommended values for default-src: self

,HIGH

*.googleapis.com *.google.com.np *.google.cn *.google.cat *.google.com.nf *.google.com.bo *.google.com.pk *.google.gr *.google.bg *.doubleclick.net *.google.ge *.google.com.bz *.google.co.in *.google.co.ke *.google.fr *.facebook.com *.google.com.mt *.google.gm *.neopay.lt *.google.cd *.google.de *.google.co.ma 'unsafe-inline' *.google.com.my region1.google-analytics.com *.google.fi *.google.ml *.google.mu *.google.com.ng *.google.ms *.gstatic.com *.google.at *.omnisnippet1.com *.google.cm *.google.as *.google.ae *.google.ne *.google.hn *.google.bi *.google.com.gh babydo.ee *.google.ca *.google.lu *.google.je *.google.com.au wt.omnisendlink.com *.google.com.kw *.google.cz *.google.gl *.google.gy *.google.mw facebook.net *.google.bj *.google.com.mm *.google.com *.google.dk *.google.az *.google.nr formsv2.soundestlink.com *.google.bf *.google.cg *.google.com.gt *.google.com.af *.google.me *.google.ps *.google.fm *.google.com.pr *.google.cc *.google.com.ly *.google.com.ag *.google.al *.google.kg *.google.pt *.google.com.ai *.google.bs *.google.com.bn *.google.co.ls *.google.co.ck *.google.ie *.google.it *.google.com.do *.google.com.gi *.google.co.cr *.google.io *.google.ee *.google.be *.google.com.cy *.google.iq *.google.ad 'self' *.google.com.lc *.google.dm connect.facebook.net g.cn *.google.ga *.google.ac *.google.com.ni *.google.com.om *.google.am *.google.bt *.google.com.hk *.google.com.br *.google.la *.google.mn *.google.com.et *.googletagmanager.com *.google.com.p *.google.gf babydo.lv *.google.mk *.google.com.na *.google.nu *.google.co.ao *.google.li *.google.cf *.google.com.eg *.google.hr *.google.com.ec *.google.cl *.google.dz *.google.gg *.google.com.pa *.google.co.kr *.google.com.ph *.google.kz *.google.pl *.google-analytics.com 'unsafe-eval' *.google.es *.google.dj *.google.mv *.google.co.mz stats.g.doubleclick.net *.google.com.fj *.google.com.lb *.google.co.nz *.google.com.pe *.google.im *.google.com.co forms.soundestlink.com *.google.com.bh *.google.co.id *.google.nl *.google.ci *.google.co.il *.google.lt https://www.google-analytics.com *.google.ba *.google.ki *.omnivasiunta.lt *.google.md *.google.co.jp *.google.lk *.google.com.pg *.google.com.kh *.google.ch *.google.jo *.google.hu *.google.mg *.google.gp *.google.com.mx *.google.com.bd data: *.google.no *.google.by *.google.com.ar *.google.lv *.soundestlink.com omnisnippet1.com *.google.co.bw *.google.ht *.google.co.pn img-src *.google.com.cu *.google.cv *.google.com.jm *.google.pn *.google.is

•Unknown directive: ,

•Unsafe inline execution allowed in ,

•Unsafe eval() execution allowed in ,

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

2 recommended security headers are missing on babydo.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about babydo.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

babydo.lt

3 scans since 7/15/2025

Latest: 70/100

Total Scans

Latest Score

70/100

First Scan

7/15/2025

Last Scan

7/15/2025

Score Trend

Security score progression over 2 scans

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 15, 2025	B (70)	No	4/6	0	View →
Jul 15, 2025	B (70)	No	4/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for babydo.lt

HTML

<a href="https://headertest.com/results/babydo.lt" title="Security headers grade for babydo.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/babydo.lt" alt="HeaderTest security grade: B (70/100) for babydo.lt" />
</a>

Markdown

[![HeaderTest security grade: B (70/100) for babydo.lt](https://headertest.com/api/badge/babydo.lt)](https://headertest.com/results/babydo.lt)