← All Results
Domain History

dolle.lt

Grade B · 70/100 · 3/6 security headers present

Security Score

B
70/ 100

Security Headers

3/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
font-src fonts.googleapis.com fonts.gstatic.com *.googleapis.com *.gstatic.com data: https://fonts.gstatic.com 'self' data: 'unsafe-inline' data: *.usercentrics.eu *.stripe.com *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com *.fontawesome.com https://fonts.bunny.net maxcdn.bootstrapcdn.com pouch-global-font-assets.s3.eu-central-1.amazonaws.com *.preply.com *.slant.co *.sogem.ro *.sogem-sa.com *.tailwindapp.com *.typekit.net data: 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com *.paypal.com *.stripe.com *.cardinalcommerce.com 3ds-secure.cardcomplete.com www.clicksafe.lloydstsb.com pay.activa-card.com *.wirecard.com acs.sia.eu *.touchtechpayments.com www.securesuite.co.uk rsa3dsauth.com *.monzo.com *.arcot.com *.wlp-acs.com * *.facebook.com 'self' 'unsafe-inline'; frame-ancestors www.gstatic.com *.stripe.com stripe.com *.link.com *.amazon.com 'self'; frame-src fast.amc.demdex.net *.adobe.com bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ www.google.com *.google.com *.stripe.com *.usercentrics.eu klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com c.paypal.com checkout.paypal.com assets.braintreegateway.com pay.google.com *.cardinalcommerce.com *.paypal.com * *.weltpixel.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; img-src assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com *.ftcdn.net *.behance.net t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io https://images.unsplash.com maps.googleapis.com maps.gstatic.com *.gstatic.com *.googleapis.com 'self' data: 'unsafe-inline' data: *.stripe.com *.usercentrics.eu magefan.com cm.magefan.com https://firebasestorage.googleapis.com www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com checkout.paypal.com *.paypal.com *.facebook.com *.reddit.com *.baidu.com *.bing.com dolle.com *.dolle.com *.dolle.de *.dolle.dk *.dolle.no *.dolle-uk.co.uk *.doubleclick.net *.edesk.com *.googleadservices.com *.google-analytics.com www.google.ad www.google.ae www.google.al www.google.at www.google.az www.google.ba www.google.be www.google.bf www.google.bg www.google.bj www.google.bs www.google.by www.google.ca www.google.cd www.google.cg www.google.ch www.google.ci www.google.cm www.google.co.ao www.google.co.cr www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.ke www.google.co.kr www.google.co.ma www.google.com.ag www.google.com.ar www.google.com.au www.google.com.bd www.google.com.bh www.google.com.br www.google.com.co www.google.com.cy www.google.com.eg www.google.com.gh www.google.com.hk www.google.com.kw www.google.com.lb www.google.com.ly www.google.com.mt www.google.com.mx www.google.com.my www.google.com.ng www.google.com.om www.google.com.pe www.google.com.ph www.google.com.pk www.google.com.qa www.google.com.sa www.google.com.sg www.google.com.tr www.google.com.tw www.google.com.ua www.google.com.vn www.google.co.nz www.google.co.th www.google.co.uk www.google.co.uz www.google.co.ve www.google.co.za www.google.co.zw www.google.cv www.google.cz www.google.de www.google.dk www.google.dz www.google.ee www.google.es www.google.fi www.google.fr www.google.ga www.google.ge www.google.gg www.google.gl www.google.gm www.google.gr www.google.hr www.google.ht www.google.hu www.google.ie www.google.im www.google.iq www.google.is www.google.it www.google.je www.google.kz www.google.la www.google.lk www.google.lt www.google.lu www.google.lv www.google.md www.google.mg www.google.mk www.google.ml www.google.mn www.google.mu www.google.mv www.google.nl www.google.no www.google.pl www.google.pt www.google.ro www.google.rs www.google.ru www.google.rw www.google.sc www.google.se www.google.sh www.google.si www.google.sk www.google.sn www.google.td www.google.tg www.google.tn google.com *.google.com *.googlesyndication.com *.googletagmanager.com *.linkedin.com *.placeholder.com *.sharepoint.com *.sogem-espana.es *.sogem.eu *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov xsellco-blobstore.s3.amazonaws.com *.yandex.ru yastatic.net *.ytimg.com data: 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes';, script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://maps.googleapis.com maps.googleapis.com maps.gstatic.com fonts.googleapis.com *.googleapis.com *.gstatic.com https://cdn.jsdelivr.net/npm/@ryangjchandler/[email protected]/dist/spruce.umd.js www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.google.com *.goo.gle *.googlecommerce.com *.googletagmanager.com *.stripe.com *.usercentrics.eu *.dolle.com *.stripe.network *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.amazon.com *.link.com *.avada.io js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com https://www.googletagmanager.com tagmanager.google.com *.facebook.net *.redditstatic.com *.reddit.com *.tiktok.com unpkg.com *.bing.com *.blueai.dk *.braintreegateway.com *.callconversions.co.uk *.cardinalcommerce.com *.cookieinformation.com *.doubleclick.net *.e2-1.dev *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.jsdelivr.net *.licdn.com localhost *.pinimg.com *.pinterest.com *.sogem-espana.es *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov *.tawk.to *.userlink.ai *.vimeo.com *.weply.chat *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com fonts.googleapis.com https://fonts.googleapis.com *.googleapis.com *.stripe.com *.usercentrics.eu *.stripe.network *.stripecdn.com *.amazon.com *.fontawesome.com https://fonts.bunny.net unsafe-inline assets.braintreegateway.com maxcdn.bootstrapcdn.com tagmanager.google.com *.dolle.com *.googletagmanager.com *.gstatic.com *.sogem-espana.es *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov *.vimeocdn.com *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.dolle-uk.co.uk *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com https://maps.googleapis.com https://player.vimeo.com maps.googleapis.com maps.gstatic.com fonts.googleapis.com *.googleapis.com *.paypal.com *.stripe.com *.usercentrics.eu klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com https://get.geojs.io *.avada.io api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.cardinalcommerce.com *.google.com google.com *.google-analytics.com *.facebook.net *.redditstatic.com *.reddit.com *.tiktok.com *.doubleclick.net *.run.app *.bing.com *.blueai.dk *.callconversions.co.uk *.cookieinformation.com *.dolle.com *.e2-1.dev *.facebook.com www.google.ae www.google.at www.google.az www.google.be www.google.bg www.google.ca www.google.ch www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.kr www.google.com.ag www.google.com.au www.google.com.bh www.google.com.br www.google.com.cy www.google.com.eg www.google.com.hk www.google.com.mt www.google.com.mx www.google.com.my www.google.com.ng www.google.com.om www.google.com.pk www.google.com.qa www.google.com.sa www.google.com.sg www.google.com.tr www.google.com.ua www.google.com.vn www.google.co.nz www.google.co.th www.google.co.uk www.google.co.ve www.google.co.za www.google.cz www.google.de www.google.dk www.google.ee www.google.es www.google.fi www.google.fr www.google.gg www.google.gl www.google.gr www.google.hr www.google.hu www.google.ie www.google.im www.google.is www.google.it www.google.je www.google.kz www.google.lk www.google.lt www.google.lu www.google.lv www.google.nl www.google.no www.google.pl www.google.pt www.google.ro www.google.rs www.google.se www.google.si www.google.sk *.googlesyndication.com kg668dbov0.execute-api.us-east-1.amazonaws.com *.linkedin.com localhost *.pinterest.com *.samsung.com *.sogem.nl *.sogem.ro *.tawk.to *.userlink.ai *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src *.callconversions.co.uk dolle.com *.dolle.com *.dolle.dk *.dolle.no *.dolle-uk.co.uk *.doubleclick.net *.facebook.com *.facebook.net *.google-analytics.com *.googleapis.com www.google.be www.google.ca www.google.ch www.google.co.uk www.google.cz www.google.de www.google.dk www.google.fr www.google.is www.google.no www.google.pl www.google.pt www.google.ro www.google.ru www.google.se *.google.com *.googletagmanager.com *.gstatic.com *.linkedin.com *.pinimg.com *.posadzimy.pl *.sogem-sa.com *.usercentrics.eu *.userlink.ai *.vimeocdn.com *.vimeo.com *.youtube.com *.youtube-nocookie.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes';, base-uri 'self' 'unsafe-inline'; report-uri https://f9d2d55d-c24d-416d-ab9d-a236d6a690cd.sansec.watch/; report-to report-endpoint;
Directive Analysis
font-srcHIGH
*.stripe.com klarna.com *.sogem-sa.com *.stripecdn.com *.klarna.com *.amazon.com *.link.com *.klarnaevt.com *.usercentrics.eu 'unsafe-hashes' maxcdn.bootstrapcdn.com fonts.gstatic.com *.preply.com *.klarnacdn.net https://fonts.bunny.net pouch-global-font-assets.s3.eu-central-1.amazonaws.com 'unsafe-eval' 'unsafe-inline' *.gstatic.com data: *.sogem.ro fonts.googleapis.com *.tailwindapp.com https://fonts.gstatic.com *.googleapis.com *.slant.co *.fontawesome.com 'self' *.typekit.net
•Unsafe eval() execution allowed in font-src
•Unsafe inline execution allowed in font-src
•Missing recommended values for font-src: self
form-actionHIGH
*.arcot.com *.stripe.com geostag.cardinalcommerce.com *.facebook.com pilot-payflowlink.paypal.com *.wirecard.com 1eafstag.cardinalcommerce.com * geo.cardinalcommerce.com *.touchtechpayments.com *.cardinalcommerce.com pay.activa-card.com 'unsafe-inline' 1eaf.cardinalcommerce.com *.wlp-acs.com rsa3dsauth.com centinelapi.cardinalcommerce.com *.paypal.com *.monzo.com www.sandbox.paypal.com 3ds-secure.cardcomplete.com www.paypal.com www.securesuite.co.uk 'self' centinelapistag.cardinalcommerce.com acs.sia.eu www.clicksafe.lloydstsb.com
•Overly permissive wildcard (*) in form-action
•Unsafe inline execution allowed in form-action
•Missing recommended values for form-action: self
frame-ancestorsLOW
*.stripe.com www.gstatic.com 'self' *.amazon.com *.link.com stripe.com
•Missing recommended values for frame-ancestors: none, self
frame-srcHIGH
*.stripe.com klarna.com geostag.cardinalcommerce.com pilot-payflowlink.paypal.com *.weltpixel.com *.klarna.com *.amazon.com *.link.com 1eafstag.cardinalcommerce.com * geo.cardinalcommerce.com *.klarnaevt.com *.usercentrics.eu 'unsafe-hashes' player.vimeo.com pay.google.com *.youtube-nocookie.com *.klarnacdn.net *.cardinalcommerce.com www.google.com 'unsafe-eval' *.google.com 'unsafe-inline' 1eaf.cardinalcommerce.com c.paypal.com centinelapi.cardinalcommerce.com checkout.paypal.com bid.g.doubleclick.net *.paypal.com assets.braintreegateway.com https://www.google.com/recaptcha/ www.sandbox.paypal.com fast.amc.demdex.net *.adobe.com www.paypal.com 'self' *.youtube.com centinelapistag.cardinalcommerce.com
•Overly permissive wildcard (*) in frame-src
•Unsafe eval() execution allowed in frame-src
•Unsafe inline execution allowed in frame-src
•Missing recommended values for frame-src: self
img-srcHIGH
fpdbs.paypal.com *.facebook.com www.google.gm www.google.com.qa *.sogem-sa.com www.google.rs validator.swagger.io www.google.co.id www.google.com.cy www.google.com.kw www.google.co.ma www.google.al www.google.co.zw www.google.rw www.google.es www.google.cz xsellco-blobstore.s3.amazonaws.com www.google.nl www.google.bf www.google.com.mx www.google.is www.google.com.ph www.google.no www.google.by data: www.google.com.om *.sogem.ro www.google.fi www.google.bg www.google.co.cr bid.g.doubleclick.net *.googletagmanager.com www.googletagmanager.com *.paypal.com www.google.dk www.google.com.gh *.sogem.nl assets.braintreegateway.com fpdbs.sandbox.paypal.com www.google.com.my www.google.com.ly www.google.mu www.google.se www.google-analytics.com 'self' t.paypal.com www.googleadservices.com https://images.unsplash.com www.google.com.lb *.dolle.de maps.gstatic.com *.doubleclick.net www.google.co.uz www.google.mv *.stripe.com i.ytimg.com www.google.gr www.google.ht www.google.co.ke www.google.md *.placeholder.com https://firebasestorage.googleapis.com www.google.gl dub.stats.paypal.com www.google.ch amcglobal.sc.omtrdc.net *.yandex.ru www.google.mg www.google.com.bh www.google.cd www.google.sh www.google.com.bd www.google.bs *.dolle.com www.google.com.mt www.google.sc 'unsafe-eval' dolle.com www.google.az www.google.lt www.google.com.co b.stats.paypal.com *.dolle.no www.google.com.pk www.google.com.eg *.vimeocdn.com www.google.ru *.ftcdn.net *.googleadservices.com cm.everesttech.net *.sharepoint.com www.google.com.au www.google.gg www.google.mn www.google.ro www.google.ci *.baidu.com www.google.co.ve cm.magefan.com www.google.cv www.google.co.in www.google.co.th www.google.lu www.google.pt www.google.com.hk www.google.co.uk www.google.im magefan.com www.google.co.ao google.com www.google.com.sg www.google.ba www.google.ae www.google.kz www.google.com.vn yastatic.net *.usercentrics.eu www.google.com.tw *.google-analytics.com maps.googleapis.com *.edesk.com *.ssa.gov www.google.fr www.google.it www.google.cm googleads.g.doubleclick.net 'unsafe-inline' www.google.dz www.google.td *.gstatic.com *.dolle-uk.co.uk www.google.ge www.google.si www.google.ml www.google.sk www.google.iq www.google.mk *.bing.com www.google.com.sa dpm.demdex.net www.google.co.jp www.google.com.ua www.google.ee *.adobe.com www.google.hr www.paypal.com www.google.bj www.google.ie www.google.com.pe www.google.co.za www.google.de www.google.sn analytics.google.com www.google.ad www.google.co.il www.google.com.ng www.google.com.tr www.google.cg www.google.je *.behance.net www.google.com.ag www.google.be *.linkedin.com 'unsafe-hashes' assets.adobedtm.com www.google.com www.google.ca www.google.lk www.paypalobjects.com www.google.la *.google.com *.sogem-espana.es www.google.pl widgets.magentocommerce.com c.paypal.com www.google.tg checkout.paypal.com www.google.com.br *.reddit.com www.google.co.kr *.dolle.dk www.google.at *.ytimg.com www.sandbox.paypal.com www.google.co.nz www.google.lv *.googleapis.com www.google.hu *.googlesyndication.com www.google.com.ar *.youtube.com www.google.ga *.sogem.eu www.google.tn
•Unsafe eval() execution allowed in img-src
•Unsafe inline execution allowed in img-src
•Missing recommended values for img-src: self
,HIGH
*.avada.io *.sogem-sa.com *.stripecdn.com https://www.googletagmanager.com pay.google.com *.pinimg.com https://maps.googleapis.com script-src *.sogem.ro *.licdn.com *.googletagmanager.com *.newrelic.com www.googletagmanager.com includestest.ccdc02.com *.paypal.com *.sogem.nl *.weply.chat assets.braintreegateway.com *.vimeo.com www.gstatic.com/recaptcha/ www.vimeo.com www.google-analytics.com 'self' t.paypal.com www.googleadservices.com *.callconversions.co.uk api.sandbox.braintreegateway.com maps.gstatic.com *.doubleclick.net *.stripe.com *.userlink.ai *.e2-1.dev *.klarna.com *.link.com *.googlecommerce.com *.redditstatic.com *.tiktok.com *.blueai.dk *.dolle.com client-analytics.sandbox.braintreegateway.com *.klarnacdn.net 'unsafe-eval' *.vimeocdn.com *.googleadservices.com vimeo.com *.xsellco.com *.stripe.network klarna.com geostag.cardinalcommerce.com localhost *.pinterest.com *.klarnaevt.com songbirdstag.cardinalcommerce.com *.usercentrics.eu *.google-analytics.com maps.googleapis.com *.ssa.gov *.cardinalcommerce.com https://cdn.jsdelivr.net/npm/@ryangjchandler/[email protected]/dist/spruce.umd.js googleads.g.doubleclick.net 'unsafe-inline' api.braintreegateway.com *.gstatic.com *.nr-data.net fonts.googleapis.com *.bing.com 1eafapi.cardinalcommerce.com tagmanager.google.com *.adobe.com www.paypal.com unpkg.com www.google.com/recaptcha/ *.goo.gle analytics.google.com https://www.gstatic.com/recaptcha/ *.amazon.com 1eafstag.cardinalcommerce.com s.ytimg.com 'unsafe-hashes' assets.adobedtm.com geoapi.cardinalcommerce.com *.facebook.net www.googleapis.com www.paypalobjects.com *.google.com *.sogem-espana.es *.tawk.to c.paypal.com *.cookieinformation.com js.braintreegateway.com *.braintreegateway.com *.reddit.com *.jsdelivr.net client-analytics.braintreegateway.com www.sandbox.paypal.com https://www.google.com/recaptcha/ *.googleapis.com songbird.cardinalcommerce.com *.googlesyndication.com *.youtube.com
•Unknown directive: ,
•Unsafe eval() execution allowed in ,
•Unsafe inline execution allowed in ,
style-srcHIGH
*.stripe.network *.stripe.com https://fonts.googleapis.com *.sogem-sa.com *.stripecdn.com *.amazon.com *.usercentrics.eu unsafe-inline 'unsafe-hashes' maxcdn.bootstrapcdn.com *.ssa.gov *.dolle.com https://fonts.bunny.net 'unsafe-eval' 'unsafe-inline' *.gstatic.com *.sogem-espana.es *.vimeocdn.com *.sogem.ro *.googletagmanager.com fonts.googleapis.com *.sogem.nl assets.braintreegateway.com *.googleapis.com *.adobe.com tagmanager.google.com *.fontawesome.com 'self' *.xsellco.com
•Unsafe eval() execution allowed in style-src
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha384-, nonce-, sha256-, sha512-, self
object-srcHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in object-src
•Missing recommended values for object-src: none
media-srcHIGH
*.dolle-uk.co.uk 'unsafe-hashes' *.adobe.com 'self' 'unsafe-eval' 'unsafe-inline' *.gstatic.com
•Unsafe eval() execution allowed in media-src
•Unsafe inline execution allowed in media-src
•Missing recommended values for media-src: self
manifest-srcHIGH
'unsafe-inline' 'self'
•Unsafe inline execution allowed in manifest-src
•Missing recommended values for manifest-src: self
connect-srcHIGH
*.facebook.com *.samsung.com *.avada.io www.google.com.qa www.google.rs www.google.co.id www.google.com.cy geo.cardinalcommerce.com www.google.es www.google.cz www.google.nl https://maps.googleapis.com www.google.com.mx www.google.is www.google.no www.google.com.om *.sogem.ro www.google.fi www.google.bg *.newrelic.com www.googletagmanager.com *.paypal.com www.google.dk *.sogem.nl www.google.com.my www.google.se www.google-analytics.com 'self' www.googleadservices.com centinelapistag.cardinalcommerce.com *.callconversions.co.uk api.sandbox.braintreegateway.com maps.gstatic.com *.doubleclick.net *.stripe.com www.google.gr *.userlink.ai *.e2-1.dev www.google.gl *.klarna.com *.link.com www.google.ch amcglobal.sc.omtrdc.net *.redditstatic.com *.tiktok.com *.blueai.dk www.google.com.bh https://get.geojs.io client-analytics.sandbox.braintreegateway.com *.dolle.com *.klarnacdn.net www.google.com.mt 'unsafe-eval' www.google.az www.google.lt 1eaf.cardinalcommerce.com www.google.com.pk www.google.com.eg www.google.com.au www.google.gg www.google.ro *.run.app www.google.co.ve vimeo.com *.xsellco.com www.google.co.in www.google.co.th www.google.lu www.google.pt www.google.com.hk klarna.com geostag.cardinalcommerce.com www.google.co.uk pilot-payflowlink.paypal.com www.google.im google.com www.google.com.sg www.google.kz www.google.ae localhost *.pinterest.com www.google.com.vn *.klarnaevt.com *.usercentrics.eu *.google-analytics.com maps.googleapis.com *.cardinalcommerce.com www.google.fr www.google.it 'unsafe-inline' api.braintreegateway.com *.nr-data.net *.braintree-api.com www.google.si fonts.googleapis.com www.google.sk *.bing.com www.google.com.sa dpm.demdex.net www.google.co.jp www.google.com.ua www.google.ee www.google.hr www.paypal.com www.google.ie www.google.co.za www.google.de analytics.google.com kg668dbov0.execute-api.us-east-1.amazonaws.com www.google.co.il www.google.com.ng https://player.vimeo.com *.amazon.com www.google.com.tr 1eafstag.cardinalcommerce.com www.google.je www.google.com.ag www.google.be *.linkedin.com 'unsafe-hashes' *.facebook.net www.google.ca www.google.lk www.paypalobjects.com *.google.com www.google.pl *.tawk.to *.cookieinformation.com centinelapi.cardinalcommerce.com www.google.com.br *.reddit.com www.google.co.kr www.google.at client-analytics.braintreegateway.com www.sandbox.paypal.com www.google.co.nz www.google.lv *.googleapis.com www.google.hu *.googlesyndication.com
•Unsafe eval() execution allowed in connect-src
•Unsafe inline execution allowed in connect-src
•Missing recommended values for connect-src: self
child-srcHIGH
c.paypal.com http: *.paypal.com blob: https: 'self' assets.braintreegateway.com 'unsafe-inline'
•Unknown directive: child-src
•Insecure HTTP source allowed in child-src
•Unsafe inline execution allowed in child-src
default-srcHIGH
*.facebook.com *.posadzimy.pl *.userlink.ai www.google.co.uk *.sogem-sa.com www.google.ch *.usercentrics.eu www.google.be *.google-analytics.com *.linkedin.com 'unsafe-hashes' www.google.cz *.pinimg.com *.dolle.com *.youtube-nocookie.com *.facebook.net www.google.ca www.google.fr www.google.is 'unsafe-eval' dolle.com *.google.com 'unsafe-inline' *.dolle.no *.gstatic.com www.google.no *.dolle-uk.co.uk www.google.pl *.vimeocdn.com www.google.ru *.googletagmanager.com www.google.dk *.dolle.dk www.google.ro *.vimeo.com *.googleapis.com www.google.se 'self' *.youtube.com www.google.de *.callconversions.co.uk *.doubleclick.net www.google.pt
•Unsafe eval() execution allowed in default-src
•Unsafe inline execution allowed in default-src
•Missing recommended values for default-src: self
,HIGH
base-uri 'unsafe-inline' 'self'
•Unknown directive: ,
•Unsafe inline execution allowed in ,
report-uriLOW
https://f9d2d55d-c24d-416d-ab9d-a236d6a690cd.sansec.watch/
report-toLOW
report-endpoint

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"
✗Strict-Transport-SecurityMissing

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

How to add it:

nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
cloudflare
SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)
✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on dolle.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about dolle.ltWeak headers often come with other exposure — check the full picture.

dolle.lt

2 scans since 7/15/2025

B

Latest: 70/100

Total Scans

2

Latest Score

70/100

First Scan

7/15/2025

Last Scan

7/15/2025

Scan History

DateScoreCSPHeadersIssuesAction
Jul 15, 2025
B (70)
No
3/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for dolle.lt
HTML
<a href="https://headertest.com/results/dolle.lt" title="Security headers grade for dolle.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/dolle.lt" alt="HeaderTest security grade: B (70/100) for dolle.lt" />
</a>
Markdown
[![HeaderTest security grade: B (70/100) for dolle.lt](https://headertest.com/api/badge/dolle.lt)](https://headertest.com/results/dolle.lt)