HomeFeaturesGuidesBlogResultsAPISign Up
← All Results
Domain History

berner.lt

Grade C · 60/100 · 3/6 security headers present

Security Score

C
60/ 100

Security Headers

3/ 6

CSP Violations

2Violations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
frame-ancestors 'self' *.kameleoon.com mediaserver.berner.eu mediaserver.bti.de
Directive Analysis
frame-ancestorsLOW
mediaserver.bti.de *.kameleoon.com 'self' mediaserver.berner.eu
•Missing recommended values for frame-ancestors: self, none
Content Security PolicyHIGH
connect-src 'self' mediaserver.bti.de mediaserver.berner.eu cdn-icons-png.flaticon.com *.doubleclick.net *.bing.com sgtm.bti.de sgtm.berner.eu *.kameleoon.com *.kameleoon.eu *.kameleoon.io *.usercentrics.eu *.iadvize.com *.slgnt.eu *.clarity.ms *.googleapis.com widget.usersnap.com www.google.com www.googletagmanager.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com www.google-analytics.com www.facebook.com *.typekit.net adservice.google.com checkoutshopper-test.adyen.com www.google.fr www.google.be maps.gstatic.com www.google.at *.linkedin.com targetemsecure.blob.core.windows.net snap.licdn.com www.googleadservices.com; default-src 'self' 'unsafe-inline'; font-src 'self' *.typekit.net *.google.com fonts.gstatic.com userlike-cdn-umm.b-cdn.net d3dc1lgancj6l0.cloudfront.net *.doubleclick.net; frame-src 'self' mediaserver.bti.de mediaserver.berner.eu *.google.com *.bing.com *.typekit.net www.google.at www.google.be www.google.fr checkoutshopper-test.adyen.com googleusercontent.com *.adsrvr.org www.facebook.com consentcdn.cookiebot.com *.iadvize.com *.googleapis.com www.googletagmanager.com *.doubleclick.net userlike-cdn-widgets.s3-eu-west-1.amazonaws.com www.google-analytics.com *.linkedin.com targetemsecure.blob.core.windows.net snap.licdn.com; img-src 'self' cdn-icons-png.flaticon.com *.doubleclick.net www.google.at maps.gstatic.com www.google.be www.google.fr checkoutshopper-test.adyen.com adservice.google.com *.kameleoon.com *.kameleoon.eu *.kameleoon.io *.usercentrics.eu *.bing.com www.bti.de shop.berner.eu *.linkedin.com *.bti.de mediaserver.berner.eu sgtm.berner.eu *.dc.bgcloudservice.com www.facebook.com *.google.com www.google.de maps.googleapis.com www.googletagmanager.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com www.google-analytics.com *.iadvize.com targetemsecure.blob.core.windows.net snap.licdn.com www.googleadservices.com; media-src 'self' *.googleapis.com mediaserver.bti.de mediaserver.berner.eu; script-src 'report-sample' 'self' 'unsafe-eval' 'unsafe-inline' *.google.com *.doubleclick.net *.typekit.net checkoutshopper-test.adyen.com www.googletagmanager.com *.usersnap.com *.usercentrics.eu *.jquery.com *.adsrvr.org *.google.com *.gstatic.com www.googleadservices.com sgtm.bti.de sgtm.berner.eu *.kameleoon.eu *.kameleoon.io *.epoq.de *.bing.com connect.facebook.net www.facebook.com *.clarity.ms d3dc1lgancj6l0.cloudfront.net userlike-cdn-widgets.s3-eu-west-1.amazonaws.com *.iadvize.com targetemsecure.blob.core.windows.net snap.licdn.com *.googleapis.com *.linkedin.com privacy-proxy.usercentrics.eu code.jquery.com; style-src-elem 'self' 'unsafe-inline' *.bing.com *.typekit.net checkoutshopper-test.adyen.com *.google.com *.googleapis.com *.doubleclick.net www.facebook.com *.iadvize.com *.linkedin.com targetemsecure.blob.core.windows.net snap.licdn.com www.googleadservices.com
Directive Analysis
connect-srcLOW
*.iadvize.com cdn-icons-png.flaticon.com *.bing.com mediaserver.bti.de sgtm.bti.de *.slgnt.eu sgtm.berner.eu *.kameleoon.io www.google.at userlike-cdn-widgets.s3-eu-west-1.amazonaws.com *.clarity.ms *.kameleoon.com www.googleadservices.com *.linkedin.com www.google.be www.google-analytics.com snap.licdn.com 'self' mediaserver.berner.eu *.typekit.net *.googleapis.com maps.gstatic.com www.googletagmanager.com www.google.fr *.kameleoon.eu www.google.com adservice.google.com widget.usersnap.com checkoutshopper-test.adyen.com *.usercentrics.eu www.facebook.com targetemsecure.blob.core.windows.net *.doubleclick.net
•Missing recommended values for connect-src: self
default-srcHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in default-src
•Missing recommended values for default-src: self
font-srcLOW
*.google.com d3dc1lgancj6l0.cloudfront.net userlike-cdn-umm.b-cdn.net fonts.gstatic.com 'self' *.typekit.net *.doubleclick.net
•Missing recommended values for font-src: self
frame-srcLOW
*.adsrvr.org *.iadvize.com *.bing.com mediaserver.bti.de www.google.at userlike-cdn-widgets.s3-eu-west-1.amazonaws.com *.linkedin.com www.google.be www.google-analytics.com consentcdn.cookiebot.com *.google.com snap.licdn.com 'self' mediaserver.berner.eu *.typekit.net *.googleapis.com www.googletagmanager.com www.google.fr googleusercontent.com checkoutshopper-test.adyen.com www.facebook.com targetemsecure.blob.core.windows.net *.doubleclick.net
•Missing recommended values for frame-src: self
img-srcLOW
*.iadvize.com shop.berner.eu cdn-icons-png.flaticon.com *.bing.com sgtm.berner.eu www.google.at *.kameleoon.io userlike-cdn-widgets.s3-eu-west-1.amazonaws.com maps.googleapis.com *.kameleoon.com www.googleadservices.com *.linkedin.com www.bti.de www.google.be www.google-analytics.com *.google.com www.google.de *.bti.de snap.licdn.com 'self' mediaserver.berner.eu maps.gstatic.com www.googletagmanager.com www.google.fr *.kameleoon.eu adservice.google.com checkoutshopper-test.adyen.com *.usercentrics.eu www.facebook.com *.dc.bgcloudservice.com targetemsecure.blob.core.windows.net *.doubleclick.net
•Missing recommended values for img-src: self
media-srcLOW
*.googleapis.com mediaserver.bti.de 'self' mediaserver.berner.eu
•Missing recommended values for media-src: self
script-srcHIGH
*.adsrvr.org *.iadvize.com code.jquery.com *.bing.com *.epoq.de *.usersnap.com sgtm.bti.de sgtm.berner.eu *.kameleoon.io userlike-cdn-widgets.s3-eu-west-1.amazonaws.com *.clarity.ms *.gstatic.com 'report-sample' www.googleadservices.com *.linkedin.com *.google.com snap.licdn.com 'unsafe-eval' 'self' *.typekit.net *.googleapis.com www.googletagmanager.com *.jquery.com *.kameleoon.eu d3dc1lgancj6l0.cloudfront.net connect.facebook.net checkoutshopper-test.adyen.com privacy-proxy.usercentrics.eu 'unsafe-inline' *.usercentrics.eu www.facebook.com targetemsecure.blob.core.windows.net *.doubleclick.net
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: self, sha256-, nonce-, sha384-, sha512-
•No nonces or hashes used for script-src
style-src-elemHIGH
*.google.com *.iadvize.com snap.licdn.com 'self' *.typekit.net *.bing.com checkoutshopper-test.adyen.com 'unsafe-inline' *.googleapis.com www.facebook.com www.googleadservices.com *.linkedin.com targetemsecure.blob.core.windows.net *.doubleclick.net
•Unknown directive: style-src-elem
•Unsafe inline execution allowed in style-src-elem

Violations

•https://web.cmp.usercentrics.eu/ui/v/3.61.0/UcGdprCmpView.798088a7.js 96 [Report Only] Refused to load the image 'data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2248%22%20height%3D%2248%22%20viewBox%3D%220%2096%20960%20960%22%3E%3Cpath%20d%3D%22m249%20849-42-42%20231-231-231-231%2042-42%20231%20231%20231-231%2042%2042-231%20231%20231%20231-42%2042-231-231z%22%2F%3E%3C%2Fsvg%3E' because it violates the following Content Security Policy directive: "img-src 'self' cdn-icons-png.flaticon.com *.doubleclick.net www.google.at maps.gstatic.com www.google.be www.google.fr checkoutshopper-test.adyen.com adservice.google.com *.kameleoon.com *.kameleoon.eu *.kameleoon.io *.usercentrics.eu *.bing.com www.bti.de shop.berner.eu *.linkedin.com *.bti.de mediaserver.berner.eu sgtm.berner.eu *.dc.bgcloudservice.com www.facebook.com *.google.com www.google.de maps.googleapis.com www.googletagmanager.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com www.google-analytics.com *.iadvize.com targetemsecure.blob.core.windows.net snap.licdn.com www.googleadservices.com".
•https://web.cmp.usercentrics.eu/ui/v/3.61.0/UcGdprCmpView.798088a7.js 96 [Report Only] Refused to load the image 'data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2248%22%20height%3D%2248%22%20viewBox%3D%220%2096%20960%20960%22%3E%3Cpath%20d%3D%22M378%20810%20154%20586l43-43%20181%20181%20384-384%2043%2043z%22%2F%3E%3C%2Fsvg%3E' because it violates the following Content Security Policy directive: "img-src 'self' cdn-icons-png.flaticon.com *.doubleclick.net www.google.at maps.gstatic.com www.google.be www.google.fr checkoutshopper-test.adyen.com adservice.google.com *.kameleoon.com *.kameleoon.eu *.kameleoon.io *.usercentrics.eu *.bing.com www.bti.de shop.berner.eu *.linkedin.com *.bti.de mediaserver.berner.eu sgtm.berner.eu *.dc.bgcloudservice.com www.facebook.com *.google.com www.google.de maps.googleapis.com www.googletagmanager.com userlike-cdn-widgets.s3-eu-west-1.amazonaws.com www.google-analytics.com *.iadvize.com targetemsecure.blob.core.windows.net snap.licdn.com www.googleadservices.com".

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✓Referrer-PolicyPresent

same-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✗X-Frame-OptionsMissing

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

How to add it:

nginx
add_header X-Frame-Options "DENY" always;
apache
Header always set X-Frame-Options "DENY"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"
✗X-XSS-ProtectionMissing

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

How to add it:

nginx
add_header X-XSS-Protection "0" always;
apache
Header always set X-XSS-Protection "0"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-XSS-Protection to "0"

3 recommended security headers are missing on berner.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about berner.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.

berner.lt

2 scans since 7/15/2025

C

Latest: 60/100

Total Scans

2

Latest Score

60/100

First Scan

7/15/2025

Last Scan

7/15/2025

Scan History

DateScoreCSPHeadersIssuesAction
Jul 15, 2025
C (60)
No
3/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: C (60/100) for berner.lt
HTML
<a href="https://headertest.com/results/berner.lt" title="Security headers grade for berner.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/berner.lt" alt="HeaderTest security grade: C (60/100) for berner.lt" />
</a>
Markdown
[![HeaderTest security grade: C (60/100) for berner.lt](https://headertest.com/api/badge/berner.lt)](https://headertest.com/results/berner.lt)