Domain History

chic.lt

Grade F · 0/100 · 3/6 security headers present

Security Score

0/ 100

Security Headers

3/ 6

CSP Violations

21Violations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

font-src fonts.googleapis.com fonts.gstatic.com *.hotjar.com *.zopim.com *.fontawesome.com 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.facebook.com 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com cdn.dnky.co youtube.com www.youtube.com *.hotjar.com *.google.com www.facebook.com 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com www.google.com www.google.nl data: connect.onlinesucces.nl px.ads.linkedin.com stats.g.doubleclick.net *.googleapis.com *.gstatic.com www.linkedin.com linkedin.com www.googletagmanager.com googletagmanager.com gallery.mailchimp.com amcglobal.sc.omtrdc.net cm.everesttech.net *.trustedshops.com www.facebook.com *.zopim.com bank.paysera.com www.apptrian.com https://omnisnippet1.com https://wt.soundestlink.com 'self' 'unsafe-inline'; script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com *.googleapis.com cdn.dnky.co checkout.buckaroo.nl *.fontawesome.com *.mailchimp.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src *.zopim.com www.apptrian.com 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';

Directive Analysis

font-srcHIGH

*.fontawesome.com *.hotjar.com 'self' fonts.gstatic.com fonts.googleapis.com 'unsafe-inline' *.zopim.com

•Unsafe inline execution allowed in font-src

•Missing recommended values for font-src: self

form-actionHIGH

test.authorize.net 1eaf.cardinalcommerce.com geostag.cardinalcommerce.com 'self' www.facebook.com secure.authorize.net 'unsafe-inline' 1eafstag.cardinalcommerce.com geo.cardinalcommerce.com centinelapi.cardinalcommerce.com centinelapistag.cardinalcommerce.com

•Unsafe inline execution allowed in form-action

•Missing recommended values for form-action: self

frame-ancestorsHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in frame-ancestors

•Missing recommended values for frame-ancestors: self, none

frame-srcHIGH

test.authorize.net 1eaf.cardinalcommerce.com www.youtube.com *.hotjar.com www.sandbox.paypal.com geostag.cardinalcommerce.com cdn.dnky.co www.paypal.com www.facebook.com *.google.com 'self' secure.authorize.net youtube.com 'unsafe-inline' 1eafstag.cardinalcommerce.com geo.cardinalcommerce.com centinelapi.cardinalcommerce.com centinelapistag.cardinalcommerce.com

•Unsafe inline execution allowed in frame-src

•Missing recommended values for frame-src: self

img-srcHIGH

www.google.nl www.linkedin.com widgets.magentocommerce.com www.googleadservices.com gallery.mailchimp.com stats.g.doubleclick.net *.gstatic.com www.google.com *.vimeocdn.com www.apptrian.com www.paypalobjects.com linkedin.com www.paypal.com t.paypal.com 'unsafe-inline' googletagmanager.com *.zopim.com *.googleapis.com https://omnisnippet1.com bank.paysera.com www.google-analytics.com www.facebook.com 'self' s.ytimg.com www.googletagmanager.com data: amcglobal.sc.omtrdc.net cm.everesttech.net fpdbs.paypal.com fpdbs.sandbox.paypal.com connect.onlinesucces.nl *.trustedshops.com px.ads.linkedin.com https://wt.soundestlink.com

•Unsafe inline execution allowed in img-src

•Missing recommended values for img-src: self

script-srcHIGH

*.zdassets.com video.google.com *.sendcloud.sc www.sandbox.paypal.com www.googleadservices.com geostag.cardinalcommerce.com 'unsafe-eval' jstest.authorize.net 1eafstag.cardinalcommerce.com www.google.com https://forms.soundestlink.com test.authorize.net *.trackedlink.net api.comapi.com www.apptrian.com www.paypalobjects.com 1eafapi.cardinalcommerce.com www.paypal.com t.paypal.com 'unsafe-inline' checkout.buckaroo.nl js.authorize.net vimeo.com cdn-scripts.signifyd.com includestest.ccdc02.com *.googleapis.com *.zopim.com *.hotjar.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com snap.licdn.com *.mailchimp.com www.gstatic.com https://omnisnippet1.com songbird.cardinalcommerce.com www.google-analytics.com 'self' s.ytimg.com geoapi.cardinalcommerce.com www.googletagmanager.com google.com chimpstatic.com www.youtube.com js.braintreegateway.com *.trustedshops.com cdn.dnky.co gstatic.com secure.authorize.net *.adyen.com www.vimeo.com assets.adobedtm.com

•Unsafe eval() execution allowed in script-src

•Unsafe inline execution allowed in script-src

•Missing recommended values for script-src: sha512-, sha256-, self, sha384-, nonce-

•No nonces or hashes used for script-src

style-srcHIGH

*.googleapis.com *.fontawesome.com *.mailchimp.com getfirebug.com cdn.dnky.co 'self' 'unsafe-inline' checkout.buckaroo.nl

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: sha512-, sha256-, self, sha384-, nonce-

object-srcHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in object-src

•Missing recommended values for object-src: none

media-srcHIGH

www.apptrian.com 'unsafe-inline' 'self' *.zopim.com

•Unsafe inline execution allowed in media-src

•Missing recommended values for media-src: self

manifest-srcHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in manifest-src

•Missing recommended values for manifest-src: self

connect-srcHIGH

1eaf.cardinalcommerce.com *.zdassets.com geostag.cardinalcommerce.com *.hotjar.io stats.g.doubleclick.net 1eafstag.cardinalcommerce.com www.apptrian.com api.comapi.com google-analytics.com 'unsafe-inline' centinelapi.cardinalcommerce.com www.feedbackcompany.com *.zopim.com centinelapistag.cardinalcommerce.com *.hotjar.com dpm.demdex.net www.google-analytics.com 'self' wss://*.zopim.com commerce.adobedc.net geo.cardinalcommerce.com

•Unsafe inline execution allowed in connect-src

•Missing recommended values for connect-src: self

child-srcHIGH

'unsafe-inline' 'self'

•Unknown directive: child-src

•Unsafe inline execution allowed in child-src

default-srcHIGH

'unsafe-eval' 'unsafe-inline' 'self'

•Unsafe eval() execution allowed in default-src

•Unsafe inline execution allowed in default-src

•Missing recommended values for default-src: self

base-uriHIGH

'unsafe-inline' 'self'

•Unsafe inline execution allowed in base-uri

•Missing recommended values for base-uri: self, none

Violations

•https://www.chic.lt/ 2527 [Report Only] Refused to load the script 'https://app.avada.io/scripttag/avada-email-marketing.min.js' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.chic.lt/ 2532 [Report Only] Refused to load the script 'https://app.avada.io/scripttag/popup/avada-popup.min.js' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://app.avada.io/scripttag/popup/avada-popup.min.js 0 [Report Only] Refused to load the script 'https://cdn.shopify.com/extensions/278bfe32-f92d-4823-b497-2d4a7b22b914/0.0.0/assets/avada-popup-main.min.js?v=1752604396125' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://app.avada.io/scripttag/avada-email-marketing.min.js 0 [Report Only] Refused to load the script 'https://cdn.shopify.com/extensions/278bfe32-f92d-4823-b497-2d4a7b22b914/0.0.0/assets/avada-email-marketing-main.min.js?v=1752604396199' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://omnisnippet1.com/inshop/launcher-v2.js 3 [Report Only] Refused to connect to 'https://wt.omnisendlink.com/REST/inShop/v1/getSettings?shopHostname=www.chic.lt&shopType=api&brandID=614752f523d8ae001a4b2c6c&responseType=json' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'".

•https://connect.facebook.net/signals/config/701843764015521?v=next&r=canary&domain=www.chic.lt&hme=3a8008a6f0cd88c861b1cd2bda7f70b9072223018277cd4c0254ee4884c65e05&ex_m=83%2C141%2C124%2C17%2C117%2C58%2C39%2C118%2C64%2C57%2C129%2C72%2C12%2C82%2C25%2C112%2C103%2C62%2C65%2C111%2C128%2C91%2C131%2C7%2C3%2C4%2C6%2C5%2C2%2C73%2C81%2C132%2C203%2C153%2C52%2C208%2C205%2C206%2C44%2C166%2C24%2C61%2C212%2C211%2C155%2C27%2C51%2C8%2C54%2C77%2C78%2C79%2C84%2C107%2C26%2C23%2C110%2C106%2C105%2C125%2C63%2C127%2C49%2C126%2C40%2C108%2C50%2C100%2C11%2C36%2C194%2C196%2C163%2C55%2C20%2C21%2C22%2C14%2C15%2C35%2C32%2C33%2C68%2C74%2C76%2C89%2C116%2C119%2C37%2C90%2C18%2C16%2C94%2C59%2C30%2C121%2C120%2C122%2C113%2C19%2C29%2C48%2C88%2C28%2C195%2C165%2C176%2C149%2C86%2C109%2C67%2C98%2C43%2C38%2C96%2C97%2C102%2C47%2C13%2C104%2C95%2C42%2C45%2C0%2C80%2C130%2C1%2C101%2C10%2C99%2C252%2C192%2C139%2C179%2C172%2C9%2C46%2C75%2C53%2C123%2C56%2C93%2C71%2C70%2C41%2C114%2C69%2C66%2C60%2C92%2C85%2C34%2C115%2C31%2C87%2C133 132 [Report Only] Refused to connect to 'https://www.facebook.com/privacy_sandbox/topics/registration/?id=701843764015521' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'".

•https://www.googletagmanager.com/gtm.js?id=GTM-NC65347 134 [Report Only] Refused to connect to 'https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.chic.lt%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=707705856.1752604396&dt=CHIC%20%E2%80%93%20mada%20gyvena%20%C4%8Dia!&auid=1068117632.1752604396&navt=n&npa=0&gtm=45He57e1h2v852294768za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104909302~104909304&tft=1752604396288&tfd=4734&apve=1&apvf=f' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'".

•https://www.googletagmanager.com/ - [Report Only] Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com cdn.dnky.co youtube.com www.youtube.com *.hotjar.com *.google.com www.facebook.com".

•https://omnisnippet1.com/monitoring/monitoring.js?v=2025-07-15T18 0 [Report Only] Refused to connect to 'https://forms.soundestlink.com/REST/forms/v1/renderedForms?v=2025-07-15T18&brandID=614752f523d8ae001a4b2c6c&displayType=popup,embedded,flyout' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'".

•https://omnisnippet1.com/monitoring/monitoring.js?v=2025-07-15T18 0 [Report Only] Refused to connect to 'https://analytics.google.com/g/collect?v=2&tid=G-FSKS8RMW31&gtm=45je57e1h2v890457159z8852294768za200zb852294768&_p=1752604395992&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255&cid=1455406777.1752604397&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&uamb=0&uam=&uap=Linux&uapv=6.8.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1752604396&sct=1&seg=0&dl=https%3A%2F%2Fwww.chic.lt%2F&dt=CHIC%20%E2%80%93%20mada%20gyvena%20%C4%8Dia!&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4999' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com commerce.adobedc.net api.comapi.com google-analytics.com www.google-analytics.com stats.g.doubleclick.net *.zdassets.com *.hotjar.com *.hotjar.io *.zopim.com wss://*.zopim.com dpm.demdex.net www.feedbackcompany.com www.apptrian.com 'self' 'unsafe-inline'".

•https://www.chic.lt/ - [Report Only] Refused to load the image 'https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-FSKS8RMW31&cid=1455406777.1752604397&gtm=45je57e1h2v890457159z8852294768za200zb852294768&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255&z=1387321255' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com www.google.com www.google.nl data: connect.onlinesucces.nl px.ads.linkedin.com stats.g.doubleclick.net *.googleapis.com *.gstatic.com www.linkedin.com linkedin.com www.googletagmanager.com googletagmanager.com gallery.mailchimp.com amcglobal.sc.omtrdc.net cm.everesttech.net *.trustedshops.com www.facebook.com *.zopim.com bank.paysera.com www.apptrian.com https://omnisnippet1.com https://wt.soundestlink.com 'self' 'unsafe-inline'".

•https://www.googletagmanager.com/gtag/destination?id=AW-343149238&cx=c&gtm=45je57e1h2v890457159za200zb852294768&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255 108 [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net/pagead/viewthroughconversion/343149238/?random=1752604396657&cv=11&fst=1752604396657&bg=ffffff&guid=ON&async=1&gtm=45be57e1h2z8852294768za200zb852294768&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104909302~104909304&u_w=800&u_h=600&url=https%3A%2F%2Fwww.chic.lt%2F&hn=www.googleadservices.com&frm=0&tiba=CHIC%20%E2%80%93%20mada%20gyvena%20%C4%8Dia!&npa=0&pscdl=noapi&auid=1068117632.1752604396&uaa=x86&uab=64&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&uamb=0&uam=&uap=Linux&uapv=6.8.0&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=4' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com google.com www.google.com gstatic.com www.gstatic.com www.googletagmanager.com *.googleapis.com cdn.dnky.co api.comapi.com *.trackedlink.net snap.licdn.com chimpstatic.com checkout.buckaroo.nl *.adyen.com *.zopim.com *.hotjar.com *.zdassets.com *.sendcloud.sc *.mailchimp.com *.trustedshops.com *.fontawesome.com connect.facebook.net www.feedbackcompany.com www.apptrian.com https://omnisnippet1.com https://forms.soundestlink.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

•https://www.googletagmanager.com/ - [Report Only] Refused to frame 'https://td.doubleclick.net/' because it violates the following Content Security Policy directive: "frame-src 'self' geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com cdn.dnky.co youtube.com www.youtube.com *.hotjar.com *.google.com www.facebook.com".

•https://www.chic.lt/ - [Report Only] Refused to load the image 'https://www.google.ca/pagead/1p-user-list/343149238/?random=1752604396657&cv=11&fst=1752602400000&bg=ffffff&guid=ON&async=1&gtm=45be57e1h2z8852294768za200zb852294768&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104909302~104909304&u_w=800&u_h=600&url=https%3A%2F%2Fwww.chic.lt%2F&hn=www.googleadservices.com&frm=0&tiba=CHIC%20%E2%80%93%20mada%20gyvena%20%C4%8Dia!&npa=0&pscdl=noapi&auid=1068117632.1752604396&uaa=x86&uab=64&uafvl=Not)A%253BBrand%3B8.0.0.0%7CChromium%3B138.0.7204.100%7CGoogle%2520Chrome%3B138.0.7204.100&uamb=0&uam=&uap=Linux&uapv=6.8.0&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDZpuyzZxyJu5XA82R1MXUKQWrLcWy0SqM0Cg&random=1715491922&rmt_tld=1&ipr=y' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com www.google.com www.google.nl data: connect.onlinesucces.nl px.ads.linkedin.com stats.g.doubleclick.net *.googleapis.com *.gstatic.com www.linkedin.com linkedin.com www.googletagmanager.com googletagmanager.com gallery.mailchimp.com amcglobal.sc.omtrdc.net cm.everesttech.net *.trustedshops.com www.facebook.com *.zopim.com bank.paysera.com www.apptrian.com https://omnisnippet1.com https://wt.soundestlink.com 'self' 'unsafe-inline'".

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"

✗Strict-Transport-SecurityMissing

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

How to add it:

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

cloudflare

SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on chic.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about chic.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

chic.lt

2 scans since 7/15/2025

Latest: 0/100

Total Scans

Latest Score

0/100

First Scan

7/15/2025

Last Scan

7/15/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 15, 2025	F (0)	No	3/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: F (0/100) for chic.lt

HTML

<a href="https://headertest.com/results/chic.lt" title="Security headers grade for chic.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/chic.lt" alt="HeaderTest security grade: F (0/100) for chic.lt" />
</a>

Markdown

[![HeaderTest security grade: F (0/100) for chic.lt](https://headertest.com/api/badge/chic.lt)](https://headertest.com/results/chic.lt)