deshow.com
Grade F · 21/100 · 4/7 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
Security
21 / 100Critical security vulnerabilities — CSP provides minimal protection.
Compliance
56 / 100Several compliance gaps found in CSP implementation.
Best Practices
45 / 100Few best practices adopted — significant room for improvement.
CSP Analysis
frame-ancestors 'self' https://www.popular.com https://popular.com; upgrade-insecure-requests; block-all-mixed-content; default-src * 'unsafe-inline' 'unsafe-eval'; font-src 'self' data: fonts.gstatic.com cdnjs.cloudflare.com; frame-src 'self' https://www.popular.com https://popular.com bid.g.doubleclick.net www.google.com maps.google.com; img-src * data: blob: 'unsafe-inline' 'self' www.google.com.uy/ www.google.com.pr/ deshow2.azureedge.net/ www.facebook.com www.google-analytics.com secure.gravatar.com/avatar/ www.google.com/recaptcha/; child-src 'none'; manifest-src 'self'; media-src 'self'; worker-src 'none'; base-uri 'self';
Directive Analysis
Missing Directives
Security Headers
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
add_header Cross-Origin-Opener-Policy "same-origin" always;Header always set Cross-Origin-Opener-Policy "same-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valuesame-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
How to add it:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
3 recommended security headers are missing on deshow.com.
Issues Found
- •CRITICAL: Bare wildcard (*) in default-src allows ANY sourcecritical
- •CRITICAL: Bare wildcard (*) in img-src allows ANY sourcecritical
- •Deprecated: 'block-all-mixed-content' has been removed from the spec. Use 'upgrade-insecure-requests' instead.info
- •Info: 'blob:' URI in img-srcinfo
- •Info: 'data:' URI in font-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Missing CRITICAL directive script-src (JavaScript source control)critical
- •Missing HIGH directive object-src (Plugin control - should be 'none')high
- •Missing MEDIUM directive connect-src (API/XHR control - prevents data exfiltration)medium
- •Missing MEDIUM directive form-action (Form submission control - prevents form hijacking)medium
- •Missing MEDIUM directive style-src (Stylesheet source control)medium
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: Permissions-Policymedium
- •Missing security header: Strict-Transport-Securitymedium
- •Overly permissive default-src directivehigh
- •Redundant: 'block-all-mixed-content' is unnecessary when 'upgrade-insecure-requests' is present.info
- •Unsafe eval() execution allowed in default-srchigh
- •Unsafe inline execution allowed in default-srchigh
- •Unsafe inline execution allowed in img-srchigh
Recommendations
- →Add connect-src directive with appropriate restrictions
- →Add form-action directive with appropriate restrictions
- →Add object-src directive with appropriate restrictions
- →Add script-src directive with appropriate restrictions
- →Add style-src directive with appropriate restrictions
- →Consider implementing a stricter Content Security Policy
- →Replace wildcards (*) with specific source lists
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
deshow.com
2 scans since 10/8/2026
Latest: 21/100
Total Scans
2
Latest Score
21/100
First Scan
10/8/2026
Last Scan
10/9/2026
Security
21 / 100Critical security vulnerabilities — CSP provides minimal protection.
Compliance
56 / 100Several compliance gaps found in CSP implementation.
Best Practices
45 / 100Few best practices adopted — significant room for improvement.
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/deshow.com" title="Security headers grade for deshow.com — HeaderTest">
<img src="https://headertest.com/api/badge/deshow.com" alt="HeaderTest security grade: F (21/100) for deshow.com" />
</a>[](https://headertest.com/results/deshow.com)