dolle.lt
Grade B · 70/100 · 3/6 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
CSP Analysis
font-src fonts.googleapis.com fonts.gstatic.com *.googleapis.com *.gstatic.com data: https://fonts.gstatic.com 'self' data: 'unsafe-inline' data: *.usercentrics.eu *.stripe.com *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com *.fontawesome.com https://fonts.bunny.net maxcdn.bootstrapcdn.com pouch-global-font-assets.s3.eu-central-1.amazonaws.com *.preply.com *.slant.co *.sogem.ro *.sogem-sa.com *.tailwindapp.com *.typekit.net data: 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com *.paypal.com *.stripe.com *.cardinalcommerce.com 3ds-secure.cardcomplete.com www.clicksafe.lloydstsb.com pay.activa-card.com *.wirecard.com acs.sia.eu *.touchtechpayments.com www.securesuite.co.uk rsa3dsauth.com *.monzo.com *.arcot.com *.wlp-acs.com * *.facebook.com 'self' 'unsafe-inline'; frame-ancestors www.gstatic.com *.stripe.com stripe.com *.link.com *.amazon.com 'self'; frame-src fast.amc.demdex.net *.adobe.com bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ www.google.com *.google.com *.stripe.com *.usercentrics.eu klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com c.paypal.com checkout.paypal.com assets.braintreegateway.com pay.google.com *.cardinalcommerce.com *.paypal.com * *.weltpixel.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; img-src assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com *.ftcdn.net *.behance.net t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com validator.swagger.io https://images.unsplash.com maps.googleapis.com maps.gstatic.com *.gstatic.com *.googleapis.com 'self' data: 'unsafe-inline' data: *.stripe.com *.usercentrics.eu magefan.com cm.magefan.com https://firebasestorage.googleapis.com www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com checkout.paypal.com *.paypal.com *.facebook.com *.reddit.com *.baidu.com *.bing.com dolle.com *.dolle.com *.dolle.de *.dolle.dk *.dolle.no *.dolle-uk.co.uk *.doubleclick.net *.edesk.com *.googleadservices.com *.google-analytics.com www.google.ad www.google.ae www.google.al www.google.at www.google.az www.google.ba www.google.be www.google.bf www.google.bg www.google.bj www.google.bs www.google.by www.google.ca www.google.cd www.google.cg www.google.ch www.google.ci www.google.cm www.google.co.ao www.google.co.cr www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.ke www.google.co.kr www.google.co.ma www.google.com.ag www.google.com.ar www.google.com.au www.google.com.bd www.google.com.bh www.google.com.br www.google.com.co www.google.com.cy www.google.com.eg www.google.com.gh www.google.com.hk www.google.com.kw www.google.com.lb www.google.com.ly www.google.com.mt www.google.com.mx www.google.com.my www.google.com.ng www.google.com.om www.google.com.pe www.google.com.ph www.google.com.pk www.google.com.qa www.google.com.sa www.google.com.sg www.google.com.tr www.google.com.tw www.google.com.ua www.google.com.vn www.google.co.nz www.google.co.th www.google.co.uk www.google.co.uz www.google.co.ve www.google.co.za www.google.co.zw www.google.cv www.google.cz www.google.de www.google.dk www.google.dz www.google.ee www.google.es www.google.fi www.google.fr www.google.ga www.google.ge www.google.gg www.google.gl www.google.gm www.google.gr www.google.hr www.google.ht www.google.hu www.google.ie www.google.im www.google.iq www.google.is www.google.it www.google.je www.google.kz www.google.la www.google.lk www.google.lt www.google.lu www.google.lv www.google.md www.google.mg www.google.mk www.google.ml www.google.mn www.google.mu www.google.mv www.google.nl www.google.no www.google.pl www.google.pt www.google.ro www.google.rs www.google.ru www.google.rw www.google.sc www.google.se www.google.sh www.google.si www.google.sk www.google.sn www.google.td www.google.tg www.google.tn google.com *.google.com *.googlesyndication.com *.googletagmanager.com *.linkedin.com *.placeholder.com *.sharepoint.com *.sogem-espana.es *.sogem.eu *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov xsellco-blobstore.s3.amazonaws.com *.yandex.ru yastatic.net *.ytimg.com data: 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes';, script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://maps.googleapis.com maps.googleapis.com maps.gstatic.com fonts.googleapis.com *.googleapis.com *.gstatic.com https://cdn.jsdelivr.net/npm/@ryangjchandler/[email protected]/dist/spruce.umd.js www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.google.com *.goo.gle *.googlecommerce.com *.googletagmanager.com *.stripe.com *.usercentrics.eu *.dolle.com *.stripe.network *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.amazon.com *.link.com *.avada.io js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com https://www.googletagmanager.com tagmanager.google.com *.facebook.net *.redditstatic.com *.reddit.com *.tiktok.com unpkg.com *.bing.com *.blueai.dk *.braintreegateway.com *.callconversions.co.uk *.cardinalcommerce.com *.cookieinformation.com *.doubleclick.net *.e2-1.dev *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.jsdelivr.net *.licdn.com localhost *.pinimg.com *.pinterest.com *.sogem-espana.es *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov *.tawk.to *.userlink.ai *.vimeo.com *.weply.chat *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com fonts.googleapis.com https://fonts.googleapis.com *.googleapis.com *.stripe.com *.usercentrics.eu *.stripe.network *.stripecdn.com *.amazon.com *.fontawesome.com https://fonts.bunny.net unsafe-inline assets.braintreegateway.com maxcdn.bootstrapcdn.com tagmanager.google.com *.dolle.com *.googletagmanager.com *.gstatic.com *.sogem-espana.es *.sogem.nl *.sogem.ro *.sogem-sa.com *.ssa.gov *.vimeocdn.com *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.dolle-uk.co.uk *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com https://maps.googleapis.com https://player.vimeo.com maps.googleapis.com maps.gstatic.com fonts.googleapis.com *.googleapis.com *.paypal.com *.stripe.com *.usercentrics.eu klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com https://get.geojs.io *.avada.io api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.cardinalcommerce.com *.google.com google.com *.google-analytics.com *.facebook.net *.redditstatic.com *.reddit.com *.tiktok.com *.doubleclick.net *.run.app *.bing.com *.blueai.dk *.callconversions.co.uk *.cookieinformation.com *.dolle.com *.e2-1.dev *.facebook.com www.google.ae www.google.at www.google.az www.google.be www.google.bg www.google.ca www.google.ch www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.kr www.google.com.ag www.google.com.au www.google.com.bh www.google.com.br www.google.com.cy www.google.com.eg www.google.com.hk www.google.com.mt www.google.com.mx www.google.com.my www.google.com.ng www.google.com.om www.google.com.pk www.google.com.qa www.google.com.sa www.google.com.sg www.google.com.tr www.google.com.ua www.google.com.vn www.google.co.nz www.google.co.th www.google.co.uk www.google.co.ve www.google.co.za www.google.cz www.google.de www.google.dk www.google.ee www.google.es www.google.fi www.google.fr www.google.gg www.google.gl www.google.gr www.google.hr www.google.hu www.google.ie www.google.im www.google.is www.google.it www.google.je www.google.kz www.google.lk www.google.lt www.google.lu www.google.lv www.google.nl www.google.no www.google.pl www.google.pt www.google.ro www.google.rs www.google.se www.google.si www.google.sk *.googlesyndication.com kg668dbov0.execute-api.us-east-1.amazonaws.com *.linkedin.com localhost *.pinterest.com *.samsung.com *.sogem.nl *.sogem.ro *.tawk.to *.userlink.ai *.xsellco.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src *.callconversions.co.uk dolle.com *.dolle.com *.dolle.dk *.dolle.no *.dolle-uk.co.uk *.doubleclick.net *.facebook.com *.facebook.net *.google-analytics.com *.googleapis.com www.google.be www.google.ca www.google.ch www.google.co.uk www.google.cz www.google.de www.google.dk www.google.fr www.google.is www.google.no www.google.pl www.google.pt www.google.ro www.google.ru www.google.se *.google.com *.googletagmanager.com *.gstatic.com *.linkedin.com *.pinimg.com *.posadzimy.pl *.sogem-sa.com *.usercentrics.eu *.userlink.ai *.vimeocdn.com *.vimeo.com *.youtube.com *.youtube-nocookie.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes';, base-uri 'self' 'unsafe-inline'; report-uri https://f9d2d55d-c24d-416d-ab9d-a236d6a690cd.sansec.watch/; report-to report-endpoint;
Directive Analysis
Security Headers
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valueControls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Header always set Referrer-Policy "strict-origin-when-cross-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
How to add it:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
3 recommended security headers are missing on dolle.lt.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
dolle.lt
2 scans since 7/15/2025
Latest: 70/100
Total Scans
2
Latest Score
70/100
First Scan
7/15/2025
Last Scan
7/15/2025
Scan History
| Date | Score | CSP | Headers | Issues | Action |
|---|---|---|---|---|---|
| Jul 15, 2025 | B (70) | No | 3/6 | 0 | View → |
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/dolle.lt" title="Security headers grade for dolle.lt — HeaderTest">
<img src="https://headertest.com/api/badge/dolle.lt" alt="HeaderTest security grade: B (70/100) for dolle.lt" />
</a>[](https://headertest.com/results/dolle.lt)