britishcouncil.lt
Grade A+ · 90/100 · 5/6 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
CSP Analysis
report-uri https://f6044819c139be406e5131b1724188ab.report-uri.com/r/t/csp/enforce; worker-src blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: bccdn.britishcouncil.org ba.live.ghs.britishcouncil.ba gr.live.ghs.britishcouncil.gr ssl.pstatic.net d.line-scdn.net *.yahoo.co.jp *.insightful-enterprise-intelligence.com *.yimg.jp *.adnxs.com *.adroll.com *.ads-twitter.com *.akamaihd.net *.appier.net *.arabclicks.com *.artfut.com *.bizographics.com *.clarity.ms *.disqus.com *.disquscdn.com *.doubleclick.net *.facebook.com *.fbcdn.net *.fospha.com *.go-mpulse.net *.google-analytics.com *.google.co.uk *.google.com *.googleadservices.com *.googleapis.com *.googlesyndication.com *.gstatic.com *.hotjar.com *.hs-analytics.net *.hs-banner.com *.hs-scripts.com *.hsadspixel.net *.hsforms.net *.hubspot.com *.ibytedtos.com *.instagram.com *.linkedin.com *.mathtag.com *.openx.net *.optimizely.com *.pardot.com *.qualaroo.com *.salesforceliveagent.com *.scupio.com *.semasio.net *.sharethis.com *.shorthand.com *.shorthandstories.com *.snapchat.com *.socdm.com *.streamamg.com *.stripe.com *.tiktok.com *.twimg.com *.twitter.com *.usemessages.com *.vimeocdn.com *.yahoo.com *.youtube-nocookie.com *.ytimg.com aa.agkn.com apps-cdn.britishcouncil.org assets.app.smart-tribune.com b92.yahoo.co.jp bam.nr-data.net bat.bing.com bc.ad.daum.net bigsea.frontend.weborama.fr bookeo.com britishcouncil-email.createsend.com britishcouncil.github.io britishcouncil.wufoo.com cdn-assets-prod.s3.amazonaws.com cdn.cookielaw.org *.debugbear.com cdnapisec.kaltura.com connect.facebook.net cookies.onetrust.com cs.gssprt.jp cx.atdmt.com d17m68fovwmgxj.cloudfront.net dev.visualwebsiteoptimizer.com disqus.com dx.bigsea.weborama.com embed.scribblelive.com geolocation.onetrust.com hsforms.net https://bccdn.azureedge.net/product-finder/pf-bundle.js https://js-eu1.hsleadflows.net/leadflows.js https://js-eu1.hubspot.com/web-interactives-embed.js https://js-eu1.hsadspixel.net/fb.js https://js-eu1.usemessages.com/conversations-embed.js idsync.rlcdn.com js-agent.newrelic.com js.hscollectedforms.net loadus.exelator.com match.adsrvr.org ml314.com olc.live.solas.britishcouncil.digital optanon.blob.core optimizely.s3.amazonaws.com pixel.rubiconproject.com player.vimeo.com ps.eyeota.net public.tableau.com s.yimg.com s3.amazonaws.com sc-static.net snap.licdn.com snap.licdn.com/li.lms-analytics/insight.min.js ssp.adskom.com stags.bluekai.com sui.britishcouncil.org sync.ad-stir.com sync.adap.tv sync.adaptv.advertising.com sync.crwdcntrl.net t1.daumcdn.net tags.clickintext.net tapestry.tapad.com ucarecdn.com vimeo.com vk.com wcs.naver.net www-2903b.bookeo.com www.google.de www.google.es www.googleoptimize.com www.googletagmanager.com www.teachingenglish.org.uk www.youtube.com x.bidswitch.net;
Directive Analysis
Security Headers
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valueno-referrer-when-downgrade
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
max-age=15768000
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SameOrigin
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on britishcouncil.lt.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
britishcouncil.lt
3 scans since 7/15/2025
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/15/2025
Last Scan
7/15/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/britishcouncil.lt" title="Security headers grade for britishcouncil.lt — HeaderTest">
<img src="https://headertest.com/api/badge/britishcouncil.lt" alt="HeaderTest security grade: A+ (90/100) for britishcouncil.lt" />
</a>[](https://headertest.com/results/britishcouncil.lt)