← All Results
Domain History

depile.ee

Grade B · 70/100 · 3/6 security headers present

Security Score

B
70/ 100

Security Headers

3/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
font-src *.fontawesome.com https://fonts.gstatic.com https://www.google.com https://www.gstatic.com *.yotpo.com *.googleapis.com *.gstatic.com data: 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.yotpo.com 'self' 'unsafe-inline'; frame-ancestors 'self'; frame-src fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com *.youtube.com https://www.google.com/recaptcha/ c.paypal.com checkout.paypal.com assets.braintreegateway.com pay.google.com *.cardinalcommerce.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.payments-amazon.com *.payments-amazon.co.uk *.payments-amazon.co.jp *.payments-amazon.jp *.payments-amazon.it *.payments-amazon.fr *.payments-amazon.es *.payments-amazon.de *.dotdigital-pages.com *.dotdigital.com cdn.dnky.co webchat.dotdigital.com js.stripe.com *.yotpo.com 'self' 'unsafe-inline'; img-src assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com validator.swagger.io www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com checkout.paypal.com d3sbl0c71oxeok.cloudfront.net dhkkzdfmpzvap.cloudfront.net d2bpzs5y44q6e0.cloudfront.net d37shgu97oizpd.cloudfront.net d1zlqll3enr74n.cloudfront.net d1jynp0fpwn93a.cloudfront.net d2cb3tokgpwh3v.cloudfront.net d1re8bfxx3pw6e.cloudfront.net d35u8xwkxs8vpe.cloudfront.net d13s9xffygp5o.cloudfront.net d388nbw0dwi1jm.cloudfront.net d11p2vtu3dppaw.cloudfront.net d3r89hiip86hka.cloudfront.net dc7snq0c8ipyk.cloudfront.net d5c7kvljggzso.cloudfront.net d2h8yg3ypfzua1.cloudfront.net d1b556x7apj5fb.cloudfront.net draz1ib3z71v2.cloudfront.net dr6hdp4s5yzfc.cloudfront.net d2bomicxw8p7ii.cloudfront.net d3aypcdgvjnnam.cloudfront.net d2a3iuf10348gy.cloudfront.net *.ssl-images-amazon.com *.ssl-images-amazon.co.uk *.ssl-images-amazon.co.jp *.ssl-images-amazon.jp *.ssl-images-amazon.it *.ssl-images-amazon.fr *.ssl-images-amazon.es *.ssl-images-amazon.de *.media-amazon.com *.media-amazon.co.uk *.media-amazon.co.jp *.media-amazon.jp *.media-amazon.it *.media-amazon.fr *.media-amazon.es *.media-amazon.de https://map.plugins.itella.com public.montonio.com self: *.googletagmanager.com *.gstatic.com *.google.ee *.yotpo.com data: 'self' 'unsafe-inline'; script-src assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com www.paypalobjects.com js.braintreegateway.com www.paypal.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com maps.googleapis.com *.payments-amazon.com *.payments-amazon.co.uk *.payments-amazon.co.jp *.payments-amazon.jp *.payments-amazon.it *.payments-amazon.fr *.payments-amazon.es *.payments-amazon.de *.trackedlink.net *.trackedweb.net *.dotdigital-pages.com cdn.dnky.co webchat.dotdigital.com public.montonio.com js.stripe.com *.googletagmanager.com *.google-analytics.com s7.addthis.com *.googleapis.com *.google.com *.gstatic.com *.avada.io *.yotpo.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.adobe.com unsafe-inline cdn.dnky.co webchat.dotdigital.com https://unpkg.com *.googletagmanager.com *.fontawesome.com *.googleapis.com *.google.com *.gstatic.com *.yotpo.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.amazonpay.com *.amazonpay.co.uk *.amazonpay.co.jp *.amazonpay.jp *.amazonpay.it *.amazonpay.fr *.amazonpay.es *.amazonpay.de mws.amazonservices.com mws.amazonservices.co.uk mws.amazonservices.co.jp mws.amazonservices.jp mws.amazonservices.it mws.amazonservices.fr mws.amazonservices.es mws.amazonservices.de *.trackedlink.net *.trackedweb.net *.dotdigital-pages.com webchat.dotdigital.com api.sandbox-card-payments.montonio.com api.card-payments.montonio.com *.google-analytics.com *.google.com ekr.zdassets.com/ http://dpm.demdex.net https://www.google.com https://www.gstatic.com https://get.geojs.io *.avada.io *.yotpo.com 'self' 'unsafe-inline'; child-src assets.braintreegateway.com c.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
Directive Analysis
font-srcHIGH
*.googleapis.com https://www.google.com *.fontawesome.com *.yotpo.com https://fonts.gstatic.com https://www.gstatic.com 'unsafe-inline' 'self' *.gstatic.com data:
•Unsafe inline execution allowed in font-src
•Missing recommended values for font-src: self
form-actionHIGH
1eaf.cardinalcommerce.com *.yotpo.com *.amazon.fr centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com *.amazon.it test.authorize.net centinelapistag.cardinalcommerce.com secure.authorize.net 'self' 1eafstag.cardinalcommerce.com *.amazon.es *.amazon.co.uk *.amazon.de geostag.cardinalcommerce.com geo.cardinalcommerce.com *.amazon.com *.amazon.jp 'unsafe-inline' *.amazon.co.jp
•Unsafe inline execution allowed in form-action
•Missing recommended values for form-action: self
frame-ancestorsLOW
'self'
•Missing recommended values for frame-ancestors: self, none
frame-srcHIGH
https://www.google.com/recaptcha/ *.payments-amazon.de 1eaf.cardinalcommerce.com c.paypal.com *.youtube.com cdn.dnky.co *.yotpo.com *.payments-amazon.it *.amazon.fr *.payments-amazon.com pay.google.com *.cardinalcommerce.com *.amazon.co.jp *.payments-amazon.co.uk centinelapi.cardinalcommerce.com assets.braintreegateway.com *.adobe.com pilot-payflowlink.paypal.com *.amazon.it test.authorize.net www.paypal.com centinelapistag.cardinalcommerce.com secure.authorize.net js.stripe.com webchat.dotdigital.com 'self' 1eafstag.cardinalcommerce.com *.amazon.es player.vimeo.com checkout.paypal.com *.payments-amazon.co.jp *.payments-amazon.jp *.amazon.co.uk *.payments-amazon.es *.amazon.de geostag.cardinalcommerce.com fast.amc.demdex.net geo.cardinalcommerce.com *.amazon.com *.amazon.jp 'unsafe-inline' *.payments-amazon.fr *.dotdigital-pages.com www.sandbox.paypal.com *.dotdigital.com
•Unsafe inline execution allowed in frame-src
•Missing recommended values for frame-src: self
img-srcHIGH
c.paypal.com dc7snq0c8ipyk.cloudfront.net d11p2vtu3dppaw.cloudfront.net d1b556x7apj5fb.cloudfront.net d2bomicxw8p7ii.cloudfront.net *.media-amazon.co.uk *.behance.net *.yotpo.com widgets.magentocommerce.com d3aypcdgvjnnam.cloudfront.net d2cb3tokgpwh3v.cloudfront.net *.media-amazon.jp *.media-amazon.fr dhkkzdfmpzvap.cloudfront.net https://map.plugins.itella.com i.ytimg.com d388nbw0dwi1jm.cloudfront.net public.montonio.com assets.braintreegateway.com *.adobe.com *.ssl-images-amazon.com *.ftcdn.net d2a3iuf10348gy.cloudfront.net amcglobal.sc.omtrdc.net www.paypal.com b.stats.paypal.com d35u8xwkxs8vpe.cloudfront.net d37shgu97oizpd.cloudfront.net *.gstatic.com draz1ib3z71v2.cloudfront.net 'self' d2h8yg3ypfzua1.cloudfront.net fpdbs.sandbox.paypal.com d2bpzs5y44q6e0.cloudfront.net assets.adobedtm.com dub.stats.paypal.com *.google.ee www.googleadservices.com cm.everesttech.net *.ssl-images-amazon.co.uk d13s9xffygp5o.cloudfront.net checkout.paypal.com *.ssl-images-amazon.fr *.ssl-images-amazon.jp d1re8bfxx3pw6e.cloudfront.net *.media-amazon.com d3sbl0c71oxeok.cloudfront.net d1zlqll3enr74n.cloudfront.net d1jynp0fpwn93a.cloudfront.net dpm.demdex.net data: d3r89hiip86hka.cloudfront.net www.google-analytics.com *.ssl-images-amazon.co.jp *.ssl-images-amazon.it *.vimeocdn.com d5c7kvljggzso.cloudfront.net t.paypal.com *.media-amazon.it *.media-amazon.de *.googletagmanager.com www.paypalobjects.com 'unsafe-inline' *.media-amazon.es validator.swagger.io fpdbs.paypal.com *.ssl-images-amazon.es self: dr6hdp4s5yzfc.cloudfront.net *.ssl-images-amazon.de www.sandbox.paypal.com *.media-amazon.co.jp
•Unsafe inline execution allowed in img-src
•Missing recommended values for img-src: self
script-srcHIGH
https://www.google.com/recaptcha/ api.braintreegateway.com *.payments-amazon.de c.paypal.com cdn.dnky.co *.yotpo.com *.payments-amazon.it *.payments-amazon.com 'unsafe-eval' pay.google.com *.payments-amazon.co.uk *.google-analytics.com public.montonio.com assets.braintreegateway.com *.adobe.com client-analytics.sandbox.braintreegateway.com test.authorize.net 1eafapi.cardinalcommerce.com *.avada.io www.paypal.com secure.authorize.net js.stripe.com www.vimeo.com webchat.dotdigital.com *.gstatic.com www.googleapis.com 'self' *.googleapis.com 1eafstag.cardinalcommerce.com *.trackedlink.net assets.adobedtm.com www.googleadservices.com includestest.ccdc02.com *.trackedweb.net maps.googleapis.com *.payments-amazon.co.jp https://www.gstatic.com/recaptcha/ client-analytics.braintreegateway.com *.payments-amazon.jp songbird.cardinalcommerce.com *.payments-amazon.es www.google-analytics.com *.vimeocdn.com geostag.cardinalcommerce.com t.paypal.com vimeo.com *.googletagmanager.com www.paypalobjects.com 'unsafe-inline' *.payments-amazon.fr js.braintreegateway.com *.dotdigital-pages.com s.ytimg.com s7.addthis.com api.sandbox.braintreegateway.com *.google.com www.sandbox.paypal.com geoapi.cardinalcommerce.com
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: sha256-, self, sha512-, nonce-, sha384-
•No nonces or hashes used for script-src
style-srcHIGH
*.googleapis.com *.google.com https://unpkg.com *.adobe.com *.googletagmanager.com cdn.dnky.co *.fontawesome.com *.yotpo.com 'unsafe-inline' webchat.dotdigital.com *.gstatic.com unsafe-inline 'self'
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, self, sha512-, nonce-, sha384-
object-srcHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in object-src
•Missing recommended values for object-src: none
media-srcHIGH
'unsafe-inline' 'self' *.adobe.com
•Unsafe inline execution allowed in media-src
•Missing recommended values for media-src: self
manifest-srcHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in manifest-src
•Missing recommended values for manifest-src: self
connect-srcHIGH
api.braintreegateway.com 1eaf.cardinalcommerce.com mws.amazonservices.co.jp http://dpm.demdex.net *.yotpo.com *.amazonpay.it *.amazon.fr *.amazonpay.co.uk *.amazon.co.jp *.google-analytics.com centinelapi.cardinalcommerce.com *.amazonpay.jp client-analytics.sandbox.braintreegateway.com *.amazon.it *.amazonpay.de api.sandbox-card-payments.montonio.com amcglobal.sc.omtrdc.net *.avada.io www.paypal.com https://www.gstatic.com mws.amazonservices.it centinelapistag.cardinalcommerce.com mws.amazonservices.jp api.card-payments.montonio.com webchat.dotdigital.com 'self' 1eafstag.cardinalcommerce.com *.trackedlink.net *.amazon.es mws.amazonservices.fr *.amazonpay.fr *.amazonpay.es mws.amazonservices.com https://get.geojs.io *.trackedweb.net *.braintree-api.com client-analytics.braintreegateway.com *.amazonpay.co.jp *.amazon.co.uk dpm.demdex.net *.amazonpay.com www.google-analytics.com *.amazon.de geostag.cardinalcommerce.com mws.amazonservices.co.uk https://www.google.com geo.cardinalcommerce.com *.amazon.com *.amazon.jp www.paypalobjects.com mws.amazonservices.de 'unsafe-inline' *.dotdigital-pages.com ekr.zdassets.com/ api.sandbox.braintreegateway.com *.google.com www.sandbox.paypal.com mws.amazonservices.es
•Insecure HTTP source allowed in connect-src
•Unsafe inline execution allowed in connect-src
•Missing recommended values for connect-src: self
child-srcHIGH
assets.braintreegateway.com c.paypal.com https: http: 'unsafe-inline' blob: 'self'
•Unknown directive: child-src
•Insecure HTTP source allowed in child-src
•Unsafe inline execution allowed in child-src
default-srcHIGH
'unsafe-inline' 'unsafe-eval' 'self'
•Unsafe inline execution allowed in default-src
•Unsafe eval() execution allowed in default-src
•Missing recommended values for default-src: self
base-uriHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in base-uri
•Missing recommended values for base-uri: self, none

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"
✗Strict-Transport-SecurityMissing

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

How to add it:

nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
cloudflare
SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)
✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN, SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on depile.ee.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about depile.eeWeak headers often come with other exposure — check the full picture.

depile.ee

2 scans since 7/18/2025

B

Latest: 70/100

Total Scans

2

Latest Score

70/100

First Scan

7/18/2025

Last Scan

7/18/2025

Scan History

DateScoreCSPHeadersIssuesAction
Jul 18, 2025
B (70)
No
3/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for depile.ee
HTML
<a href="https://headertest.com/results/depile.ee" title="Security headers grade for depile.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/depile.ee" alt="HeaderTest security grade: B (70/100) for depile.ee" />
</a>
Markdown
[![HeaderTest security grade: B (70/100) for depile.ee](https://headertest.com/api/badge/depile.ee)](https://headertest.com/results/depile.ee)