← All Results
Domain History

eset.ee

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+
90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
default-src 'self'; connect-src 'self' http://ad.doubleclick.net https://*.analytics.google.com https://*.api.userway.org https://*.botframework.com https://*.clarity.ms https://*.demandbase.com https://*.demdex.net https://*.eset.com https://*.googlesyndication.com https://*.hotjar.com https://*.hotjar.io https://*.tawk.to https://*.tt.omtrdc.net https://ads.reddit.com https://adservice.google.com https://analytics.google.com https://analytics.twitter.com https://api-preview.luckyorange.com https://api.company-target.com https://api.userway.org https://app2.salesmanago.pl https://bat.bing.com https://bat.bing.net https://c.go-mpulse.net https://cc.eset.ee https://cc.shop.eset.ee https://cdn.acsbapp.com https://cdn.linkedin.oribi.io https://cdn1.esetstatic.com https://conversions-config.reddit.com https://cookies-data.onetrust.io https://ep.smct.co https://eset.tt.omtrdc.net https://geolocation.onetrust.com https://googleads.g.doubleclick.net https://grsm.io https://ipb.smct.co https://ipb.smct.io https://js.smct.co https://js.smct.io https://maps.googleapis.com https://partnerlinks.io https://pixel-config.reddit.com https://privacyportal.onetrust.com https://px.ads.linkedin.com https://realtime.luckyorange.com https://region1.google-analytics.com https://replay.uxtweak.com https://s.yimg.com https://script.crazyegg.com https://segments.company-target.com https://settings.luckyorange.com https://settings.luckyorange.net https://smct.co https://stats.g.doubleclick.net https://tracker.clickguard.com https://tracking-api.g2.com https://www.facebook.com https://www.google-analytics.com https://www.google.by https://www.google.co.uz https://www.google.com https://www.google.es https://www.google.ie https://www.google.kg https://www.google.kz https://www.google.lt https://www.google.lv https://www.google.ru https://www.googleadservices.com https://www.googletagmanager.com https://www.redditstatic.com wss://*.botframework.com wss://*.eset.com wss://*.hotjar.com wss://*.tawk.to; font-src 'self' data: https://*.eset.com https://*.gstatic.com https://*.web-assets.eset.com https://cdn.userway.org https://embed.tawk.to https://fonts.smct.co https://fonts.smct.io https://script.hotjar.com; form-action 'self' https://*.eset-la.com https://*.eset.com https://*.form.eset.com https://*.tienda.eset-la.com https://s1069307879.t.eloqua.com https://webto.salesforce.com https://www.facebook.com; frame-ancestors 'self' https://*.eset.com; frame-src 'self' https://*.eset.com https://*.fls.doubleclick.net https://*.sgtm.eset.com https://8117415.fls.doubleclick.net https://bid.g.doubleclick.net https://eset.demdex.net https://hemsync.clickagy.com https://int.form.eset.com https://js.smct.io https://ls.smct.co https://maps.google.com https://s.company-target.com https://smct.co https://td.doubleclick.net https://tpc.googlesyndication.com https://unity.survey-solutions.cloud https://vars.hotjar.com https://widget.trustpilot.com https://www.facebook.com https://www.google.com https://www.googletagmanager.com https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: http://ad.doubleclick.net https://*.adform.net https://*.ads.linkedin.com https://*.eset.com https://*.hotjar.com https://*.rlcdn.com https://*.tawk.to https://*.yahoo.co.jp https://ad.doubleclick.net https://ade.googlesyndication.com https://adservice.google.com https://alb.reddit.com https://analytics.google.com https://analytics.twitter.com https://app2.salesmanago.pl https://bat.bing.com https://bat.bing.net https://c.bing.com https://c.clarity.ms https://cdn.esetstatic.com https://cdn.jsdelivr.net https://cdn.smct.co https://cdn.smct.io https://cdn1.esetstatic.com https://cm.everesttech.net https://cm.g.doubleclick.net https://connect.facebook.net https://dc.ads.linkedin.com https://dpm.demdex.net https://events.smct.co https://googleads.g.doubleclick.net https://i.ytimg.com https://images.g2crowd.com https://maps.googleapis.com https://pagead2.googlesyndication.com https://pubads.g.doubleclick.net https://px.ads.linkedin.com https://region1.analytics.google.com https://region1.google-analytics.com https://s1069307879.t.eloqua.com https://ssl.google-analytics.com https://stats.g.doubleclick.net https://t.co https://tribl.io https://web-assets.esetstatic.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.linkedin.com; manifest-src 'self' https://*.eset.com https://*.web-assets.eset.com; media-src 'self' https://*.eset.com https://*.web-assets.eset.com https://api.userway.org https://cdn.userway.org https://embed.tawk.to; object-src 'self' https://*.eset.com https://*.web-assets.eset.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.eset.com https://*.luckyorange.com https://*.replay.uxtweak.com https://*.salesforceliveagent.com https://*.web-assets.eset.com https://acsbap.com https://acsbapp.com https://app2.salesmanago.pl https://assets.esetstatic.com https://bat.bing.com https://cdn.botframework.com https://cdn.esetstatic.com https://cdn.jsdelivr.net https://cdn.linkedin.oribi.io https://cdn.userway.org https://cdn1.esetstatic.com https://cdnjs.cloudflare.com https://connect.facebook.net https://d.la1-c2-cdg.salesforceliveagent.com https://embed.tawk.to https://googleads.g.doubleclick.net https://img06.en25.com https://invitejs.trustpilot.com https://js.partnerstack.com https://js.smct.co https://js.smct.io https://maps.googleapis.com https://pagead2.googlesyndication.com https://platform.twitter.com https://s786665.t.eloqua.com https://script.hotjar.com https://smct.co https://snap.licdn.com https://ssl.google-analytics.com https://static.ads-twitter.com https://static.hotjar.com https://tag.demandbase.com https://tpc.googlesyndication.com https://tracking-api.g2.com https://tribl.io https://widget.trustpilot.com https://www.clarity.ms https://www.google-analytics.com https://www.google.ae https://www.google.am https://www.google.be https://www.google.bg https://www.google.bs https://www.google.by https://www.google.cg https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.co.id https://www.google.co.il https://www.google.co.ke https://www.google.co.ma https://www.google.co.nz https://www.google.co.th https://www.google.co.uz https://www.google.co.ve https://www.google.co.zw https://www.google.com https://www.google.dj https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.ge https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.md https://www.google.me https://www.google.mk https://www.google.ps https://www.google.pt https://www.google.ro https://www.google.ru https://www.google.se https://www.google.si https://www.google.tn https://www.googleadservices.com https://www.googleoptimize.com https://www.googletagmanager.com https://www.gstatic.com https://www.redditstatic.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://*.eset.com https://*.hotjar.com https://*.tawk.to https://*.web-assets.eset.com https://cdn.esetstatic.com https://cdn.jsdelivr.net https://fonts.smct.co https://fonts.smct.io; worker-src 'self' https://*.eset.com; report-uri https://www-eset-com.api.cspconsole.com/v1/reports; report-to csp-endpoint;
Directive Analysis
default-srcLOW
'self'
•Missing recommended values for default-src: self
connect-srcMEDIUM
https://*.clarity.ms https://pixel-config.reddit.com https://partnerlinks.io https://s.yimg.com https://cdn1.esetstatic.com https://cdn.linkedin.oribi.io https://c.go-mpulse.net https://www.google.kz https://px.ads.linkedin.com https://ipb.smct.io https://*.botframework.com https://www.google.es https://grsm.io http://ad.doubleclick.net https://maps.googleapis.com https://cc.eset.ee https://script.crazyegg.com https://www.google.ie https://smct.co https://api-preview.luckyorange.com https://www.google.lv https://tracker.clickguard.com https://*.demdex.net https://www.redditstatic.com https://googleads.g.doubleclick.net https://*.googlesyndication.com https://cdn.acsbapp.com https://www.google.kg https://*.tt.omtrdc.net https://stats.g.doubleclick.net https://realtime.luckyorange.com https://*.tawk.to https://app2.salesmanago.pl https://js.smct.io https://settings.luckyorange.com https://region1.google-analytics.com https://www.google.co.uz https://www.googletagmanager.com https://privacyportal.onetrust.com https://www.google-analytics.com wss://*.botframework.com https://*.analytics.google.com https://cc.shop.eset.ee https://*.hotjar.io https://segments.company-target.com https://www.google.lt https://js.smct.co https://www.google.by https://replay.uxtweak.com https://api.company-target.com 'self' https://eset.tt.omtrdc.net https://conversions-config.reddit.com https://www.googleadservices.com https://*.demandbase.com https://bat.bing.com https://api.userway.org wss://*.hotjar.com https://bat.bing.net https://*.hotjar.com https://adservice.google.com https://cookies-data.onetrust.io wss://*.tawk.to https://analytics.twitter.com https://ep.smct.co https://ipb.smct.co https://tracking-api.g2.com https://www.facebook.com https://www.google.ru https://www.google.com https://ads.reddit.com https://geolocation.onetrust.com https://*.eset.com https://*.api.userway.org wss://*.eset.com https://settings.luckyorange.net https://analytics.google.com
•Insecure HTTP source allowed in connect-src
•Missing recommended values for connect-src: self
font-srcLOW
https://*.web-assets.eset.com data: https://fonts.smct.co https://script.hotjar.com https://cdn.userway.org 'self' https://embed.tawk.to https://fonts.smct.io https://*.eset.com https://*.gstatic.com
•Missing recommended values for font-src: self
form-actionLOW
https://s1069307879.t.eloqua.com https://*.tienda.eset-la.com https://*.eset-la.com https://www.facebook.com https://*.form.eset.com https://webto.salesforce.com 'self' https://*.eset.com
•Missing recommended values for form-action: self
frame-ancestorsLOW
'self' https://*.eset.com
•Missing recommended values for frame-ancestors: none, self
frame-srcLOW
https://vars.hotjar.com https://td.doubleclick.net https://smct.co https://*.sgtm.eset.com https://bid.g.doubleclick.net https://*.fls.doubleclick.net https://widget.trustpilot.com https://maps.google.com https://ls.smct.co https://www.facebook.com 'self' https://unity.survey-solutions.cloud https://www.youtube.com https://www.youtube-nocookie.com https://s.company-target.com https://eset.demdex.net https://www.google.com https://js.smct.io https://*.eset.com https://www.googletagmanager.com https://8117415.fls.doubleclick.net https://hemsync.clickagy.com https://tpc.googlesyndication.com https://int.form.eset.com
•Missing recommended values for frame-src: self
img-srcMEDIUM
https://cdn.smct.co https://t.co https://i.ytimg.com https://maps.googleapis.com https://www.google-analytics.com https://analytics.twitter.com https://images.g2crowd.com https://c.bing.com https://cdn1.esetstatic.com https://googleads.g.doubleclick.net https://www.facebook.com https://web-assets.esetstatic.com 'self' https://pubads.g.doubleclick.net https://px.ads.linkedin.com https://*.rlcdn.com https://events.smct.co https://s1069307879.t.eloqua.com https://www.googleadservices.com https://dpm.demdex.net https://pagead2.googlesyndication.com https://stats.g.doubleclick.net https://*.tawk.to https://www.google.com https://bat.bing.com https://app2.salesmanago.pl https://cm.g.doubleclick.net http://ad.doubleclick.net https://*.eset.com https://dc.ads.linkedin.com https://ssl.google-analytics.com https://ad.doubleclick.net https://tribl.io data: https://*.ads.linkedin.com https://cdn.jsdelivr.net https://cm.everesttech.net https://region1.google-analytics.com https://*.adform.net https://www.linkedin.com https://c.clarity.ms https://bat.bing.net https://www.googletagmanager.com https://*.yahoo.co.jp https://ade.googlesyndication.com https://cdn.esetstatic.com https://cdn.smct.io https://connect.facebook.net https://*.hotjar.com https://region1.analytics.google.com https://alb.reddit.com https://adservice.google.com https://analytics.google.com
•Insecure HTTP source allowed in img-src
•Missing recommended values for img-src: self
manifest-srcLOW
https://*.web-assets.eset.com 'self' https://*.eset.com
•Missing recommended values for manifest-src: self
media-srcLOW
https://*.web-assets.eset.com https://cdn.userway.org 'self' https://embed.tawk.to https://api.userway.org https://*.eset.com
•Missing recommended values for media-src: self
object-srcLOW
https://*.web-assets.eset.com 'self' https://*.eset.com
•Missing recommended values for object-src: none
script-srcHIGH
https://cdn.userway.org https://static.ads-twitter.com https://www.clarity.ms https://widget.trustpilot.com https://acsbap.com https://cdn1.esetstatic.com https://cdn.botframework.com https://cdn.linkedin.oribi.io https://www.google.am https://www.google.co.ve https://www.google.kz https://www.google.gr https://www.google.se https://cdnjs.cloudflare.com https://www.youtube.com https://tag.demandbase.com https://www.google.md https://www.google.es https://acsbapp.com https://*.luckyorange.com https://www.googleoptimize.com https://maps.googleapis.com https://assets.esetstatic.com https://www.google.ie https://www.google.co.il https://www.google.cg https://www.gstatic.com https://smct.co https://www.google.ro https://www.google.be https://img06.en25.com https://www.google.bs https://www.redditstatic.com https://googleads.g.doubleclick.net https://www.google.dz https://www.google.fi https://www.google.kg https://app2.salesmanago.pl https://js.smct.io https://www.google.co.ke https://tribl.io https://www.google.tn https://www.google.cm https://www.google.co.uz https://snap.licdn.com https://www.google.ee https://static.hotjar.com https://www.googletagmanager.com https://cdn.esetstatic.com https://www.google.cl https://d.la1-c2-cdg.salesforceliveagent.com https://www.google-analytics.com https://www.google.co.ma https://www.google.ci https://www.google.hu https://www.google.hr https://www.google.lt 'unsafe-inline' https://js.smct.co https://www.google.by 'self' https://www.google.si https://www.googleadservices.com https://www.google.ge https://www.google.bg https://bat.bing.com https://www.google.lk https://*.replay.uxtweak.com https://js.partnerstack.com https://tpc.googlesyndication.com https://www.google.mk https://connect.facebook.net https://*.salesforceliveagent.com https://*.web-assets.eset.com https://script.hotjar.com https://www.google.co.zw 'unsafe-eval' https://www.google.ae https://tracking-api.g2.com https://platform.twitter.com https://www.google.ru https://www.google.co.id https://www.google.me https://s786665.t.eloqua.com https://pagead2.googlesyndication.com https://www.google.com https://www.google.dj https://*.eset.com https://ssl.google-analytics.com https://www.google.co.th https://invitejs.trustpilot.com https://cdn.jsdelivr.net https://www.google.ps https://www.google.pt https://www.google.co.nz https://embed.tawk.to
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha256-, sha512-, nonce-, self, sha384-
•No nonces or hashes used for script-src
style-srcHIGH
https://*.web-assets.eset.com 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.smct.co https://*.tawk.to 'self' https://cdn.esetstatic.com https://*.hotjar.com https://fonts.smct.io https://*.eset.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, sha512-, nonce-, self, sha384-
worker-srcLOW
'self' https://*.eset.com
•Missing recommended values for worker-src: none, self
report-uriLOW
https://www-eset-com.api.cspconsole.com/v1/reports
report-toLOW
csp-endpoint

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block; report=https://eset.report-uri.com/r/d/xss/enforce

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on eset.ee.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about eset.eeWeak headers often come with other exposure — check the full picture.

eset.ee

3 scans since 7/18/2025

A+

Latest: 90/100

Total Scans

3

Latest Score

90/100

First Scan

7/18/2025

Last Scan

7/18/2025

Score Trend

Security score progression over 2 scans

Scan History

DateScoreCSPHeadersIssuesAction
Jul 18, 2025
A+ (90)
No
5/60View →
Jul 18, 2025
A+ (90)
No
5/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for eset.ee
HTML
<a href="https://headertest.com/results/eset.ee" title="Security headers grade for eset.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/eset.ee" alt="HeaderTest security grade: A+ (90/100) for eset.ee" />
</a>
Markdown
[![HeaderTest security grade: A+ (90/100) for eset.ee](https://headertest.com/api/badge/eset.ee)](https://headertest.com/results/eset.ee)