Domain History

bikeshop.lt

Grade F · 0/100 · 3/6 security headers present

Security Score

0/ 100

Security Headers

3/ 6

CSP Violations

63Violations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

font-src *.fontawesome.com 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'; script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com *.fontawesome.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';

Directive Analysis

font-srcHIGH

'unsafe-inline' *.fontawesome.com 'self'

•Unsafe inline execution allowed in font-src

•Missing recommended values for font-src: self

form-actionHIGH

secure.authorize.net 1eaf.cardinalcommerce.com 'unsafe-inline' geo.cardinalcommerce.com geostag.cardinalcommerce.com centinelapi.cardinalcommerce.com test.authorize.net 'self' centinelapistag.cardinalcommerce.com 1eafstag.cardinalcommerce.com

•Unsafe inline execution allowed in form-action

•Missing recommended values for form-action: self

frame-ancestorsHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in frame-ancestors

•Missing recommended values for frame-ancestors: self, none

frame-srcHIGH

secure.authorize.net 1eaf.cardinalcommerce.com 'unsafe-inline' geo.cardinalcommerce.com www.paypal.com geostag.cardinalcommerce.com centinelapi.cardinalcommerce.com test.authorize.net www.sandbox.paypal.com 'self' centinelapistag.cardinalcommerce.com 1eafstag.cardinalcommerce.com

•Unsafe inline execution allowed in frame-src

•Missing recommended values for frame-src: self

img-srcHIGH

'unsafe-inline' www.paypalobjects.com www.paypal.com *.vimeocdn.com www.googleadservices.com s.ytimg.com www.google-analytics.com fpdbs.sandbox.paypal.com t.paypal.com 'self' widgets.magentocommerce.com fpdbs.paypal.com

•Unsafe inline execution allowed in img-src

•Missing recommended values for img-src: self

script-srcHIGH

'unsafe-inline' geostag.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com geoapi.cardinalcommerce.com js.authorize.net 'self' secure.authorize.net assets.adobedtm.com www.paypal.com s.ytimg.com vimeo.com t.paypal.com jstest.authorize.net video.google.com cdn-scripts.signifyd.com www.sandbox.paypal.com www.youtube.com www.google-analytics.com 'unsafe-eval' www.vimeo.com www.paypalobjects.com includestest.ccdc02.com www.googleadservices.com test.authorize.net js.braintreegateway.com 1eafstag.cardinalcommerce.com

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•Missing recommended values for script-src: sha384-, sha512-, self, sha256-, nonce-

•No nonces or hashes used for script-src

style-srcHIGH

'unsafe-inline' getfirebug.com *.fontawesome.com 'self'

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: sha384-, sha512-, self, sha256-, nonce-

object-srcHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in object-src

•Missing recommended values for object-src: none

media-srcHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in media-src

•Missing recommended values for media-src: self

manifest-srcHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in manifest-src

•Missing recommended values for manifest-src: self

connect-srcHIGH

'unsafe-inline' 1eaf.cardinalcommerce.com geo.cardinalcommerce.com geostag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' centinelapistag.cardinalcommerce.com 1eafstag.cardinalcommerce.com

•Unsafe inline execution allowed in connect-src

•Missing recommended values for connect-src: self

child-srcHIGH

'unsafe-inline' 'self'

•Unknown directive: child-src

•Unsafe inline execution allowed in child-src

default-srcHIGH

'unsafe-eval' 'unsafe-inline' 'self'

•Unsafe eval() execution allowed in default-src

•Unsafe inline execution allowed in default-src

•Missing recommended values for default-src: self

base-uriHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in base-uri

•Missing recommended values for base-uri: self, none

Violations

•https://www.bikeshop.lt/ - [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-VCPH9LSG8Q' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.bikeshop.lt/ 43 [Report Only] Refused to load the script 'https://connect.facebook.net/en_US/fbevents.js' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.bikeshop.lt/ 54 [Report Only] Refused to load the stylesheet 'https://fonts.googleapis.com/css?family=Bitter|Open+Sans:300,400,600,700' because it violates the following Content Security Policy directive: "style-src getfirebug.com *.fontawesome.com 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.

•https://connect.facebook.net/en_US/fbevents.js 149 [Report Only] Refused to load the script 'https://connect.facebook.net/signals/config/580823687695185?v=2.9.215&r=stable&domain=www.bikeshop.lt&hme=3a8008a6f0cd88c861b1cd2bda7f70b9072223018277cd4c0254ee4884c65e05&ex_m=83%2C141%2C124%2C17%2C117%2C58%2C39%2C118%2C64%2C57%2C129%2C72%2C12%2C82%2C25%2C112%2C103%2C62%2C65%2C111%2C128%2C91%2C131%2C7%2C3%2C4%2C6%2C5%2C2%2C73%2C81%2C132%2C203%2C153%2C52%2C208%2C205%2C206%2C44%2C166%2C24%2C61%2C212%2C211%2C155%2C27%2C51%2C8%2C54%2C77%2C78%2C79%2C84%2C107%2C26%2C23%2C110%2C106%2C105%2C125%2C63%2C127%2C49%2C126%2C40%2C108%2C50%2C100%2C11%2C36%2C194%2C196%2C163%2C20%2C21%2C22%2C14%2C15%2C35%2C32%2C33%2C68%2C74%2C76%2C89%2C116%2C119%2C37%2C90%2C18%2C16%2C94%2C59%2C30%2C121%2C120%2C122%2C113%2C19%2C29%2C48%2C88%2C28%2C176%2C149%2C86%2C109%2C67%2C98%2C43%2C38%2C96%2C97%2C102%2C47%2C13%2C104%2C95%2C55%2C42%2C45%2C0%2C80%2C130%2C1%2C101%2C10%2C99%2C252%2C192%2C139%2C179%2C172%2C9%2C46%2C75%2C53%2C123%2C56%2C93%2C71%2C70%2C41%2C114%2C69%2C66%2C60%2C92%2C85%2C34%2C115%2C31%2C87%2C133' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://connect.facebook.net/signals/config/580823687695185?v=2.9.215&r=stable&domain=www.bikeshop.lt&hme=3a8008a6f0cd88c861b1cd2bda7f70b9072223018277cd4c0254ee4884c65e05&ex_m=83%2C141%2C124%2C17%2C117%2C58%2C39%2C118%2C64%2C57%2C129%2C72%2C12%2C82%2C25%2C112%2C103%2C62%2C65%2C111%2C128%2C91%2C131%2C7%2C3%2C4%2C6%2C5%2C2%2C73%2C81%2C132%2C203%2C153%2C52%2C208%2C205%2C206%2C44%2C166%2C24%2C61%2C212%2C211%2C155%2C27%2C51%2C8%2C54%2C77%2C78%2C79%2C84%2C107%2C26%2C23%2C110%2C106%2C105%2C125%2C63%2C127%2C49%2C126%2C40%2C108%2C50%2C100%2C11%2C36%2C194%2C196%2C163%2C20%2C21%2C22%2C14%2C15%2C35%2C32%2C33%2C68%2C74%2C76%2C89%2C116%2C119%2C37%2C90%2C18%2C16%2C94%2C59%2C30%2C121%2C120%2C122%2C113%2C19%2C29%2C48%2C88%2C28%2C176%2C149%2C86%2C109%2C67%2C98%2C43%2C38%2C96%2C97%2C102%2C47%2C13%2C104%2C95%2C55%2C42%2C45%2C0%2C80%2C130%2C1%2C101%2C10%2C99%2C252%2C192%2C139%2C179%2C172%2C9%2C46%2C75%2C53%2C123%2C56%2C93%2C71%2C70%2C41%2C114%2C69%2C66%2C60%2C92%2C85%2C34%2C115%2C31%2C87%2C133 120 [Report Only] Refused to connect to 'https://www.facebook.com/privacy_sandbox/topics/registration/?id=580823687695185' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the image 'https://www.facebook.com/tr/?id=580823687695185&ev=PageView&dl=https%3A%2F%2Fwww.bikeshop.lt%2F&rl=&if=false&ts=1752598538959&sw=800&sh=600&v=2.9.215&r=stable&ec=0&o=4254&fbp=fb.1.1752598538955.750176498361430&cs_est=true&ler=empty&cdl=API_unavailable&it=1752598538887&coo=false&exp=t1&rqm=GET' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the image 'https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=580823687695185&ev=PageView&dl=https%3A%2F%2Fwww.bikeshop.lt%2F&rl=&if=false&ts=1752598538959&sw=800&sh=600&v=2.9.215&r=stable&ec=0&o=4254&fbp=fb.1.1752598538955.750176498361430&cs_est=true&ler=empty&cdl=API_unavailable&it=1752598538887&coo=false&exp=t1&rqm=FGET' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/bitter/v39/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLXOXWh2.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/bitter/v39/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLzOXWh2.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/bitter/v39/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLfOXWh2.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/bitter/v39/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLbOXWh2.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/bitter/v39/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the font 'https://fonts.gstatic.com/s/opensans/v43/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com 'self' 'unsafe-inline'".

•https://www.googletagmanager.com/gtag/js?id=G-VCPH9LSG8Q 252 [Report Only] Refused to connect to 'https://analytics.google.com/g/collect?v=2&tid=G-VCPH9LSG8Q&gtm=45je57e0v9102557242za200&_p=1752598538801&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104856541~104908318~104908320~104909302~104909304&cid=259837788.1752598539&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&uamb=0&uam=&uap=Linux&uapv=6.8.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1752598539&sct=1&seg=0&dl=https%3A%2F%2Fwww.bikeshop.lt%2F&dt=Moto%20dalys%20ir%20aksesuarai%20-%20Bikeshop.lt.%20Pristatymas%20visoje%20Lietuvoje&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1156' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'".

•https://www.googletagmanager.com/gtag/js?id=G-VCPH9LSG8Q 251 [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VCPH9LSG8Q&cid=259837788.1752598539&gtm=45je57e0v9102557242za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104856541~104908318~104908320~104909302~104909304' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ 5456 [Report Only] Refused to load the image 'https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-VCPH9LSG8Q&cid=259837788.1752598539&gtm=45je57e0v9102557242za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104856541~104908318~104908320~104909302~104909304&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104856541~104908318~104908320~104909302~104909304&z=457021202' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ 13526 [Report Only] Refused to connect to 'https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fprivacy_sandbox%2Ftopics%2Fregistration%2F%3Fid%3D580823687695185' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'".

•https://www.googleadservices.com/pagead/conversion.js 35 [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net/pagead/viewthroughconversion/961132685/?random=1752598539178&cv=9&fst=1752598539178&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465926%2C512247839%2C658953496&u_h=600&u_w=800&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bikeshop.lt%2F&tiba=Moto%20dalys%20ir%20aksesuarai%20-%20Bikeshop.lt.%20Pristatymas%20visoje%20Lietuvoje&hn=www.googleadservices.com&uaa=x86&uab=64&uam=&uap=Linux&uapv=6.8.0&uaw=0&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&rfmt=3&fmt=4' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.bikeshop.lt/ - [Report Only] Refused to load the script 'https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.bikeshop.lt/ - [Report Only] Refused to load the image 'https://www.google.com/pagead/1p-user-list/961132685/?random=1752598539178&cv=9&fst=1752595200000&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465926%2C512247839%2C658953496&u_h=600&u_w=800&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bikeshop.lt%2F&tiba=Moto%20dalys%20ir%20aksesuarai%20-%20Bikeshop.lt.%20Pristatymas%20visoje%20Lietuvoje&hn=www.googleadservices.com&uaa=x86&uab=64&uam=&uap=Linux&uapv=6.8.0&uaw=0&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDZpuyzazX2x3U6lIKs1FrR_BGl6H0TpaI2lw&random=1972260370&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

•https://www.bikeshop.lt/ - [Report Only] Refused to load the image 'https://www.google.ca/pagead/1p-user-list/961132685/?random=1752598539178&cv=9&fst=1752595200000&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465926%2C512247839%2C658953496&u_h=600&u_w=800&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bikeshop.lt%2F&tiba=Moto%20dalys%20ir%20aksesuarai%20-%20Bikeshop.lt.%20Pristatymas%20visoje%20Lietuvoje&hn=www.googleadservices.com&uaa=x86&uab=64&uam=&uap=Linux&uapv=6.8.0&uaw=0&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDZpuyzazX2x3U6lIKs1FrR_BGl6H0TpaI2lw&random=1972260370&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"

✗Strict-Transport-SecurityMissing

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

How to add it:

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

cloudflare

SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)

✓X-Content-Type-OptionsPresent

nosniff, nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block, 1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on bikeshop.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about bikeshop.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

bikeshop.lt

3 scans since 7/15/2025

Latest: 0/100

Total Scans

Latest Score

0/100

First Scan

7/15/2025

Last Scan

7/15/2025

Score Trend

Security score progression over 2 scans

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 15, 2025	F (0)	No	3/6	0	View →
Jul 15, 2025	F (0)	No	3/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: F (0/100) for bikeshop.lt

HTML

<a href="https://headertest.com/results/bikeshop.lt" title="Security headers grade for bikeshop.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/bikeshop.lt" alt="HeaderTest security grade: F (0/100) for bikeshop.lt" />
</a>

Markdown

[![HeaderTest security grade: F (0/100) for bikeshop.lt](https://headertest.com/api/badge/bikeshop.lt)](https://headertest.com/results/bikeshop.lt)