Domain History
balcia.lv
Grade A+ · 90/100 · 5/6 security headers present
Security Score
A+
90/ 100
Security Headers
5/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'self' 'unsafe-inline' data: https *.mailchimp.com *.customerioforms.com *.callpage.io *.cloudflare.com *.bing.com *.appsflyer.com google.com google.lv *.google.lv *.googleadservices.com *.pangle-ads.com *.sendpulse.com:4434 *.webpushs.com *.maze.co *.twistoo.co *.google.com *.googletagmanager.com *.googlesyndication.com *.tiktok.com *.analytics.google.com *.clarity.ms *.xcallymotion.com *.bootstrapcdn.com *.fontawesome.com *.balcia.lv *.balcia.lt *.balcia.pl *.balcia.ee *.balcia.com *.google-analytics.com *.googleapis.com *.youtube.com *.gstatic.com *.pipedrive.com *.pipedriveassets.com *.voiceflow.com wss://*.hotjar.com *.hotjar.com *.hotjar.io *.google-analytics.com *.doubleclick.net *.cookiebot.com *.facebook.com; frame-ancestors 'self'; frame-src *.google.com *.googletagmanager.com *.doubleclick.net *.gist.build *.youtube-nocookie.com *.xcallymotion.com *.cookiebot.com *.youtube.com *.hotjar.com woobox.com *.balcia.lt *.balcia.lv *.balcia.pl *.balcia.com *.pipedrive.com *.pipedriveassets.com *.facebook.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com *.callpage.io *.customerioforms.com *.cloudflare.com *.appsflyer.com *.webpushs.com *.maze.co *.twistoo.co *.tiktok.com *.customer.io *.gist.build *.bing.com *.clarity.ms woobox.com *.xcallymotion.com *.amazonaws.com *.adform.net *.google.com *.gstatic.com www.googleadservices.com *.jivosite.com connect.facebook.net *.cookiebot.com *.googleapis.com script.hotjar.com static.hotjar.com *.google-analytics.com *.demo.sk.ee *.doubleclick.net www.googletagmanager.com bank.paysera.com ajax.googleapis.com balcia.lt balcia.lv balcia.pl *.balcia.com *.pipedrive.com *.pipedriveassets.com cdn.voiceflow.com; img-src data: 'self' *.facebook.com ac-test.pl *.appsflyer.com *.googleusercontent.com *.onelink.me *.googleadservices.com *.autopay.eu flagcdn.com *.twistoo.co *.gstatic.com *.googlesyndication.com *.customer.io *.bing.com *.clarity.ms *.hotjar.com *.klix.app *.google-analytics.com bank.paysera.com *.cookiebot.com *.google.com *.google.ee *.google.lv *.google.lt *.jivosite.com *.google.pl *.doubleclick.net www.googletagmanager.com *.balcia.lt *.balcia.lv *.balcia.pl *.balcia.com *.youtube.com platonsci.bm.lv platnosci.bm.pl *.pipedrive.com *.pipedriveassets.com cm4-production-assets.s3.amazonaws.com; worker-src blob: *.balcia.pl
Directive Analysis
default-srcHIGH
*.customerioforms.com *.webpushs.com *.googlesyndication.com *.googleadservices.com *.doubleclick.net *.balcia.lt *.google.lv *.gstatic.com *.appsflyer.com *.google-analytics.com *.facebook.com *.tiktok.com 'self' *.hotjar.io *.balcia.ee *.pangle-ads.com *.voiceflow.com *.analytics.google.com 'unsafe-inline' *.balcia.com data: *.sendpulse.com:4434 *.xcallymotion.com *.balcia.pl *.mailchimp.com google.com *.twistoo.co *.balcia.lv *.pipedriveassets.com *.google.com *.callpage.io wss://*.hotjar.com *.bootstrapcdn.com *.googletagmanager.com *.clarity.ms google.lv *.cloudflare.com *.hotjar.com https *.fontawesome.com *.googleapis.com *.cookiebot.com *.youtube.com *.maze.co *.bing.com *.pipedrive.com
•Unsafe inline execution allowed in default-src
•Missing recommended values for default-src: self
frame-ancestorsLOW
'self'
•Missing recommended values for frame-ancestors: self, none
frame-srcLOW
*.googletagmanager.com *.youtube-nocookie.com *.youtube.com *.balcia.com *.hotjar.com *.xcallymotion.com *.balcia.pl *.facebook.com woobox.com *.doubleclick.net *.gist.build *.cookiebot.com *.balcia.lv *.pipedriveassets.com *.google.com *.balcia.lt *.pipedrive.com
•Missing recommended values for frame-src: self
script-srcHIGH
*.customerioforms.com *.customer.io *.webpushs.com *.doubleclick.net *.jivosite.com *.pipedrive.com cdn.voiceflow.com script.hotjar.com *.gstatic.com *.appsflyer.com *.google-analytics.com *.tiktok.com 'self' www.googletagmanager.com ajax.googleapis.com *.demo.sk.ee 'unsafe-inline' 'unsafe-eval' *.amazonaws.com *.balcia.com *.xcallymotion.com bank.paysera.com *.twistoo.co connect.facebook.net *.gist.build *.pipedriveassets.com *.google.com www.googleadservices.com balcia.lv *.callpage.io *.clarity.ms *.adform.net static.hotjar.com *.cloudflare.com *.googleapis.com balcia.lt woobox.com *.cookiebot.com *.youtube.com *.maze.co *.bing.com balcia.pl
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha512-, self, nonce-, sha384-, sha256-
•No nonces or hashes used for script-src
img-srcLOW
*.customer.io *.googlesyndication.com *.googleadservices.com *.doubleclick.net *.jivosite.com *.google.lt *.balcia.lt *.google.lv platonsci.bm.lv cm4-production-assets.s3.amazonaws.com *.gstatic.com *.appsflyer.com *.google-analytics.com *.autopay.eu *.facebook.com 'self' flagcdn.com www.googletagmanager.com *.google.pl platnosci.bm.pl ac-test.pl *.balcia.com data: *.balcia.pl bank.paysera.com *.twistoo.co *.balcia.lv *.onelink.me *.pipedriveassets.com *.google.com *.google.ee *.clarity.ms *.googleusercontent.com *.hotjar.com *.klix.app *.cookiebot.com *.youtube.com *.bing.com *.pipedrive.com
•Missing recommended values for img-src: self
worker-srcLOW
blob: *.balcia.pl
•Missing recommended values for worker-src: self, none
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
strict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubdomains
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on balcia.lv.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about balcia.lvWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
balcia.lv
3 scans since 7/17/2025
A+
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/17/2025
Last Scan
7/17/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/balcia.lv" title="Security headers grade for balcia.lv — HeaderTest">
<img src="https://headertest.com/api/badge/balcia.lv" alt="HeaderTest security grade: A+ (90/100) for balcia.lv" />
</a>Markdown
[](https://headertest.com/results/balcia.lv)