← All Results
Domain History

britishcouncil.lt

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+
90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
report-uri https://f6044819c139be406e5131b1724188ab.report-uri.com/r/t/csp/enforce; worker-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: bccdn.britishcouncil.org ba.live.ghs.britishcouncil.ba gr.live.ghs.britishcouncil.gr ssl.pstatic.net d.line-scdn.net *.yahoo.co.jp *.insightful-enterprise-intelligence.com *.yimg.jp *.adnxs.com *.adroll.com *.ads-twitter.com *.akamaihd.net *.appier.net *.arabclicks.com *.artfut.com *.bizographics.com *.clarity.ms *.disqus.com *.disquscdn.com *.doubleclick.net *.facebook.com *.fbcdn.net *.fospha.com *.go-mpulse.net *.google-analytics.com *.google.co.uk *.google.com *.googleadservices.com *.googleapis.com *.googlesyndication.com *.gstatic.com *.hotjar.com *.hs-analytics.net *.hs-banner.com *.hs-scripts.com *.hsadspixel.net *.hsforms.net *.hubspot.com *.ibytedtos.com *.instagram.com *.linkedin.com *.mathtag.com *.openx.net *.optimizely.com *.pardot.com *.qualaroo.com *.salesforceliveagent.com *.scupio.com *.semasio.net *.sharethis.com *.shorthand.com *.shorthandstories.com *.snapchat.com *.socdm.com *.streamamg.com *.stripe.com *.tiktok.com *.twimg.com *.twitter.com *.usemessages.com *.vimeocdn.com *.yahoo.com *.youtube-nocookie.com *.ytimg.com aa.agkn.com apps-cdn.britishcouncil.org assets.app.smart-tribune.com b92.yahoo.co.jp bam.nr-data.net bat.bing.com bc.ad.daum.net bigsea.frontend.weborama.fr bookeo.com britishcouncil-email.createsend.com britishcouncil.github.io britishcouncil.wufoo.com cdn-assets-prod.s3.amazonaws.com cdn.cookielaw.org *.debugbear.com cdnapisec.kaltura.com connect.facebook.net cookies.onetrust.com cs.gssprt.jp cx.atdmt.com d17m68fovwmgxj.cloudfront.net dev.visualwebsiteoptimizer.com disqus.com dx.bigsea.weborama.com embed.scribblelive.com geolocation.onetrust.com hsforms.net https://bccdn.azureedge.net/product-finder/pf-bundle.js https://js-eu1.hsleadflows.net/leadflows.js https://js-eu1.hubspot.com/web-interactives-embed.js https://js-eu1.hsadspixel.net/fb.js https://js-eu1.usemessages.com/conversations-embed.js idsync.rlcdn.com js-agent.newrelic.com js.hscollectedforms.net loadus.exelator.com match.adsrvr.org ml314.com olc.live.solas.britishcouncil.digital optanon.blob.core optimizely.s3.amazonaws.com pixel.rubiconproject.com player.vimeo.com ps.eyeota.net public.tableau.com s.yimg.com s3.amazonaws.com sc-static.net snap.licdn.com snap.licdn.com/li.lms-analytics/insight.min.js ssp.adskom.com stags.bluekai.com sui.britishcouncil.org sync.ad-stir.com sync.adap.tv sync.adaptv.advertising.com sync.crwdcntrl.net t1.daumcdn.net tags.clickintext.net tapestry.tapad.com ucarecdn.com vimeo.com vk.com wcs.naver.net www-2903b.bookeo.com www.google.de www.google.es www.googleoptimize.com www.googletagmanager.com www.teachingenglish.org.uk www.youtube.com x.bidswitch.net;
Directive Analysis
report-uriLOW
https://f6044819c139be406e5131b1724188ab.report-uri.com/r/t/csp/enforce
worker-srcLOW
blob:
•Missing recommended values for worker-src: self, none
script-srcHIGH
*.insightful-enterprise-intelligence.com *.semasio.net *.ytimg.com bccdn.britishcouncil.org *.google.com *.tiktok.com x.bidswitch.net *.adroll.com cdn-assets-prod.s3.amazonaws.com *.shorthandstories.com www.google.de *.fbcdn.net geolocation.onetrust.com snap.licdn.com *.facebook.com apps-cdn.britishcouncil.org *.disqus.com *.hotjar.com *.streamamg.com 'self' *.yimg.jp sync.adaptv.advertising.com *.appier.net *.instagram.com www.google.es *.clarity.ms hsforms.net *.googlesyndication.com *.twimg.com sync.crwdcntrl.net *.artfut.com bookeo.com *.debugbear.com vimeo.com *.disquscdn.com cdn.cookielaw.org britishcouncil.wufoo.com optanon.blob.core *.vimeocdn.com *.googleadservices.com *.bizographics.com *.googleapis.com *.qualaroo.com d17m68fovwmgxj.cloudfront.net embed.scribblelive.com *.go-mpulse.net assets.app.smart-tribune.com *.hs-analytics.net optimizely.s3.amazonaws.com britishcouncil-email.createsend.com *.optimizely.com gr.live.ghs.britishcouncil.gr *.youtube-nocookie.com ml314.com https://js-eu1.hsadspixel.net/fb.js *.twitter.com sc-static.net https://js-eu1.hubspot.com/web-interactives-embed.js https://bccdn.azureedge.net/product-finder/pf-bundle.js dx.bigsea.weborama.com blob: match.adsrvr.org *.pardot.com *.socdm.com connect.facebook.net ba.live.ghs.britishcouncil.ba *.mathtag.com sync.ad-stir.com *.fospha.com js-agent.newrelic.com tapestry.tapad.com cx.atdmt.com vk.com *.linkedin.com bc.ad.daum.net britishcouncil.github.io www.googleoptimize.com *.usemessages.com *.google-analytics.com tags.clickintext.net bigsea.frontend.weborama.fr *.yahoo.com *.stripe.com t1.daumcdn.net bam.nr-data.net cookies.onetrust.com www.teachingenglish.org.uk *.arabclicks.com *.google.co.uk *.sharethis.com *.hs-banner.com 'unsafe-inline' *.ads-twitter.com olc.live.solas.britishcouncil.digital www-2903b.bookeo.com ssl.pstatic.net *.scupio.com dev.visualwebsiteoptimizer.com *.ibytedtos.com *.hs-scripts.com bat.bing.com *.gstatic.com wcs.naver.net *.salesforceliveagent.com *.doubleclick.net *.hsforms.net *.openx.net https://js-eu1.usemessages.com/conversations-embed.js s3.amazonaws.com aa.agkn.com *.adnxs.com *.akamaihd.net disqus.com sui.britishcouncil.org ssp.adskom.com s.yimg.com *.yahoo.co.jp *.hubspot.com idsync.rlcdn.com js.hscollectedforms.net 'unsafe-eval' player.vimeo.com cdnapisec.kaltura.com stags.bluekai.com *.snapchat.com loadus.exelator.com ps.eyeota.net www.youtube.com ucarecdn.com d.line-scdn.net *.shorthand.com public.tableau.com cs.gssprt.jp sync.adap.tv www.googletagmanager.com pixel.rubiconproject.com https://js-eu1.hsleadflows.net/leadflows.js snap.licdn.com/li.lms-analytics/insight.min.js b92.yahoo.co.jp *.hsadspixel.net
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha384-, sha512-, self, nonce-, sha256-
•No nonces or hashes used for script-src

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=15768000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SameOrigin

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on britishcouncil.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about britishcouncil.ltWeak headers often come with other exposure — check the full picture.

britishcouncil.lt

3 scans since 7/15/2025

A+

Latest: 90/100

Total Scans

3

Latest Score

90/100

First Scan

7/15/2025

Last Scan

7/15/2025

Score Trend

Security score progression over 2 scans

Scan History

DateScoreCSPHeadersIssuesAction
Jul 15, 2025
A+ (90)
No
5/60View →
Jul 15, 2025
A+ (90)
No
5/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for britishcouncil.lt
HTML
<a href="https://headertest.com/results/britishcouncil.lt" title="Security headers grade for britishcouncil.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/britishcouncil.lt" alt="HeaderTest security grade: A+ (90/100) for britishcouncil.lt" />
</a>
Markdown
[![HeaderTest security grade: A+ (90/100) for britishcouncil.lt](https://headertest.com/api/badge/britishcouncil.lt)](https://headertest.com/results/britishcouncil.lt)