Domain History

foreverliving.lt

Grade B · 70/100 · 3/6 security headers present

Security Score

70/ 100

Security Headers

3/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src 'self' blob:; img-src 'self' *.ecpay.com.tw *.boxcdn.net *.maropost.com *.amazonaws.com *.adyen.com *.cloudfront.net *.userlike.com flp-service.zendesk.com static.zdassets.com consent.cookiefirst.com *.ytimg.com *.livehelpnow.net *.pcdn.co *.sharethis.com  *.contentsquare.net *.content-square.fr *.contentsquare.com *.googleapis.com *.s3.us-east-1.amazonaws.com *.s3.us-east-2.amazonaws.com  *.gstatic.com *.clicktale.net pixy.org *.chargebee.com *.nextsphere.com *.ppipe.net *.myecheck.com *.oppwa.com  *.flptitan.com *.foreverliving.com *.flpi.com foreverliving.com seeklogo.com  stats.g.doubleclick.net *.google.com www.google.com.sg data:  www.google.co.in *.vimeocdn.com *.youtube.com *.s3.amazonaws.com x1.xingassets.com  blob:  oppwa.com *.google-analytics.com s3-us-west-2.amazonaws.com *.facebook.com *.googletagmanager.com  *.boxcloud.com app.tlinky.com *.fedex.com tile.openstreetmap.org *.basemaps.cartocdn.com *.google.co.uk sp.tinymce.com *.r2.dev *.tinymce.com *.google.ie ecpg-stage.ecpay.com.tw widgets.trustedshops.com *.google.com.mm; script-src 'self' *.ecpay.com.tw *.userlike.com *.cdn01.boxcdn.net api.smooch.io *.adyen.com *.nexiopay.com *.cdn.jsdelivr.net *.jsdelivr.net *.amazonaws.com *.worldpay.com *.cloudfront.net *.mgipayments.com *.boxcdn.net *.boxcloud.com *.box.com *.s3-eu-west-1.amazonaws.com *.payvision.com *.siteprerender.com siteprerender.com *.google.com *.mgr.consensu.org *.livehelpnow.net *.contentsquare.net *.content-square.fr *.contentsquare.com *.sharethis.com walls.io  *.facebook.net *.cdn-javascript.net cdn-javascript.net x-apple-ql-id *.static-resource.com static-resource.com flpqa.com flp.com flp360.social *.flpqa.com *.flp.com *.flp360.social *.clicksapp.net clicksapp.net *.s3.us-east-1.amazonaws.com *.clicktale.net *.chargebee.com *.authorize.net *.ppipe.net www.youtube.com *.oppwa.com  *.s3-us-west-2.amazonaws.com *.myecheck.com *.googleapis.com *.flptitan.com foreverliving.com *.foreverliving.com *.flpi.com *.cloudflare.com *.bootstrapcdn.com  *.s3.amazonaws.com  *.dropbox.com *.nextsphere.com  www.googletagmanager.com *.google-analytics.com blob: *.gstatic.com test.acaptureservices.com   *.clicksafe.lloydstsb.com oppwa.com acaptureservices.com  consent.cookiefirst.com   dl.dropboxusercontent.com graph.microsoft.com static.zdassets.com js.live.net cdn.tiny.cloud *.paypal.com *.b-cdn.net ecpg-stage.ecpay.com.tw js.hs-scripts.com  clickapp.net *.nexiopaysandbox.com *.tiny.cloud *.paypalobjects.com app.tlinky.com *.r2.dev widgets.trustedshops.com  'unsafe-inline' 'unsafe-eval'; style-src 'self' *.ecpay.com.tw  *.livehelpnow.net *.adyen.com *.cookiefirst.com *.clicktale.net *.chargebee.com *.cdn.jsdelivr.net *.contentsquare.net *.content-square.fr *.contentsquare.com *.google-analytics.com *.nextsphere.com x-apple-ql-id *.s3-us-west-2.amazonaws.com *.ppipe.net *.typekit.net *.oppwa.com *.myecheck.com sp.tinymce.com *.tinymce.com cdn.tiny.cloud *.tiny.cloud *.acaptureservices.com *.flptitan.com *.foreverliving.com foreverliving.com *.flpi.com *.google.com fonts.googleapis.com cdnjs.cloudflare.com ecpg-stage.ecpay.com.tw oppwa.com *.s3.amazonaws.com maxcdn.bootstrapcdn.com *.r2.dev  app.tlinky.com *.nexiopaysandbox.com *.nexiopay.com  *.boxcdn.net googletagmanager.com cdn.honey.io 'unsafe-inline'; font-src 'self' *.ecpay.com.tw *.boxcdn.net *.cdn01.boxcdn.net *.nexiopay.com *.box.com *.cdn.jsdelivr.net *.cloudfront.net *.livehelpnow.net *.clicktale.net *.chargebee.com *.nextsphere.com *.ppipe.net *.contentsquare.net *.content-square.fr *.contentsquare.com *.typekit.net *.myecheck.com  flpqa.com flp.com flp360.social *.flpqa.com *.flp.com *.flp360.social *.bootstrapcdn.com *.oppwa.com *.flptitanqa.com *.flptitan.com *.foreverliving.com foreverliving.com *.flpi.com ecpg-stage.ecpay.com.tw data: cdnjs.cloudflare.com fonts.gstatic.com *.b-cdn.net *.s3.amazonaws.com oppwa.com 'unsafe-inline'; connect-src 'self' wss://umd.userlike.com wss://chat.userlike.com *.nexiopay.com *.s3.us-east-2.amazonaws.com v2.zopim.com ekr. flp-service.zendesk.com *.1drv.com *.cloudfront.net *.cookiefirst.com *.adyen.com *.userlike.com *.box.com *.boxcloud.com api.ipify.org *.livehelpnow.net *.consensu.org *.vimeocdn.com cdn.tiny.cloud *.tiny.cloud *.contentsquare.net *.content-square.fr *.contentsquare.com *.sharethis.com *.googleapis.com www.google.com.sg stats.g.doubleclick.net www.facebook.com *.s3.us-west-2.amazonaws.com *.socialsales.io *.clicktale.net sp.tinymce.com *.tinymce.com *.nextsphere.com  *.ppipe.net vimeo.com *.authorize.net  *.myecheck.com *.oppwa.com *.flpi.com   s3-us-west-2.amazonaws.com *.s3.amazonaws.com *.acaptureservices.com *.s3-us-west-2.amazonaws.com *.chargebee.com *.google.com oppwa.com *.mgipayments.com *.google-analytics.com www.googletagmanager.com graph.microsoft.com google.com *.worldpay.com *.zdassets.com *.trustedshops.com api.trustbadge.etrusted.com trustbadge.api.etrusted.com logging.trustbadge.com  dl.dropboxusercontent.com *.google.co.in youtube.com  *.boxcdn.net *.youtube.com wss://api.smooch.io *.s3-eu-west-1.amazonaws.com js.live.net  connect.facebook.net js.hs-scripts.com *.gstatic.com  clickapp.net cdn.jsdelivr.net static-resource.com cdn-javascript.net  *.nexiopaysandbox.com  *.flptitan.com ecpg-stage.ecpay.com.tw tile.openstreetmap.org *.basemaps.cartocdn.com flptitan.com *.r2.dev  foreverliving.com app.tlinky.com *.fbo.flptitan.com *.foreverliving.com *.fbo.foreverliving.com  www.dropbox.com *.ecpay.com.tw  zendesk-eu.my.sentry.io data: blob:; media-src 'self' *.boxcdn.net *.amazonaws.com *.userlike.com *.flptitan.com app.tlinky.com *.cloudfront.net *.youtube.com *.youtu.be *.foreverliving.com *.s3-us-west-2.amazonaws.com *.s3.us-west-2.amazonaws.com  blob:; frame-src 'self' *.datatrans.com *.mfgroup.ch *.nexiopay.com *.ngenius-payments.com *.boxcdn.net  *.flpqa.com *.userlike.com *.adyen.com *.amazonaws.com *.cloudfront.net *.facebook.com *.mgipayments.com *.livehelpnow.net *.sandbox.ngenius-payments.com *.acehubpaymentservices.com *.contentsquare.net *.content-square.fr *.contentsquare.com *.sharethis.com *.mgr.consensu.org  walls.io *.chargebee.com x-apple-ql-id *.youtube.com *.ppipe.net *.socialsales.io socialsales.io *.worldpay.com *.nextsphere.com  vimeo.com *.oppwa.com *.myecheck.com *.acaptureservices.com *.flptitan.com *.foreverliving.com *.clicksafe.lloydstsb.com foreverliving.com flptitan.com *.boxcloud.com *.flpi.com *.google.com *.vimeo.com oppwa.com  dl.dropboxusercontent.com graph.microsoft.com  acs-public.tp.mastercard.com content.googleapis.com *.nexiopaysandbox.com app.tlinky.com *.r2.dev youtu.be youtube.com www.googletagmanager.com *.cardinalcommerce.com; frame-ancestors 'self' *.socialsales.io socialsales.io *.nexiopay.com foreverliving.com *.foreverliving.com *.flptitan.com flptitan.com *.contentsquare.net *.flptitan.com:8080 *.content-square.fr *.contentsquare.com *.chargebee.com  youtu.be app.tlinky.com flpqa.com flp.com flp360.social *.flpqa.com *.nexiopaysandbox.com *.boxcdn.net *.flp.com *.flp360.social vimeo.com *.vimeo.com *.youtube.com youtube.com *.worldpay.com

Directive Analysis

default-srcLOW

'self' blob:

•Missing recommended values for default-src: self

img-srcLOW

*.r2.dev 'self' *.userlike.com *.boxcdn.net *.googletagmanager.com *.youtube.com flp-service.zendesk.com *.googleapis.com widgets.trustedshops.com www.google.co.in *.boxcloud.com *.ecpay.com.tw *.flpi.com *.s3.amazonaws.com *.ytimg.com *.google.ie *.nextsphere.com ecpg-stage.ecpay.com.tw blob: *.contentsquare.net foreverliving.com *.google.co.uk *.gstatic.com seeklogo.com sp.tinymce.com *.google-analytics.com *.foreverliving.com *.tinymce.com stats.g.doubleclick.net oppwa.com *.flptitan.com *.google.com static.zdassets.com *.google.com.mm *.fedex.com *.pcdn.co *.amazonaws.com *.clicktale.net consent.cookiefirst.com *.ppipe.net *.maropost.com *.myecheck.com *.facebook.com tile.openstreetmap.org *.chargebee.com pixy.org *.content-square.fr www.google.com.sg s3-us-west-2.amazonaws.com *.vimeocdn.com *.s3.us-east-1.amazonaws.com data: *.sharethis.com *.livehelpnow.net *.oppwa.com *.contentsquare.com *.s3.us-east-2.amazonaws.com *.adyen.com *.cloudfront.net *.basemaps.cartocdn.com x1.xingassets.com app.tlinky.com

•Missing recommended values for img-src: self

script-srcHIGH

*.r2.dev 'self' *.userlike.com *.boxcdn.net dl.dropboxusercontent.com *.worldpay.com *.s3-us-west-2.amazonaws.com *.googleapis.com *.cloudflare.com *.ecpay.com.tw *.flpi.com *.s3.amazonaws.com siteprerender.com ecpg-stage.ecpay.com.tw blob: clicksapp.net cdn-javascript.net *.foreverliving.com *.b-cdn.net *.google.com *.bootstrapcdn.com *.flp.com *.ppipe.net graph.microsoft.com *.livehelpnow.net *.s3.us-east-1.amazonaws.com *.cloudfront.net *.nexiopaysandbox.com *.s3-eu-west-1.amazonaws.com *.clicksafe.lloydstsb.com *.boxcloud.com *.mgipayments.com foreverliving.com cdn.tiny.cloud *.cdn-javascript.net *.payvision.com acaptureservices.com *.amazonaws.com *.clicktale.net *.dropbox.com *.cdn.jsdelivr.net *.mgr.consensu.org *.jsdelivr.net *.chargebee.com *.nexiopay.com clickapp.net *.cdn01.boxcdn.net js.live.net *.nextsphere.com *.authorize.net www.googletagmanager.com *.gstatic.com *.google-analytics.com *.flptitan.com *.tiny.cloud static.zdassets.com *.myecheck.com js.hs-scripts.com *.box.com *.siteprerender.com *.content-square.fr www.youtube.com *.sharethis.com *.paypalobjects.com *.contentsquare.com *.adyen.com x-apple-ql-id *.flp360.social *.static-resource.com api.smooch.io widgets.trustedshops.com *.flpqa.com flpqa.com flp360.social *.clicksapp.net *.contentsquare.net 'unsafe-inline' 'unsafe-eval' *.paypal.com oppwa.com *.facebook.net flp.com consent.cookiefirst.com walls.io static-resource.com *.oppwa.com test.acaptureservices.com app.tlinky.com

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•Missing recommended values for script-src: nonce-, self, sha384-, sha512-, sha256-

•No nonces or hashes used for script-src

style-srcHIGH

*.r2.dev 'self' *.boxcdn.net *.s3-us-west-2.amazonaws.com *.ecpay.com.tw *.flpi.com *.s3.amazonaws.com *.nextsphere.com ecpg-stage.ecpay.com.tw *.contentsquare.net sp.tinymce.com foreverliving.com fonts.googleapis.com *.google-analytics.com *.foreverliving.com 'unsafe-inline' oppwa.com *.flptitan.com *.tiny.cloud *.google.com *.typekit.net cdn.tiny.cloud *.clicktale.net *.cdn.jsdelivr.net googletagmanager.com *.cookiefirst.com cdn.honey.io *.myecheck.com *.ppipe.net maxcdn.bootstrapcdn.com *.chargebee.com *.content-square.fr cdnjs.cloudflare.com *.nexiopay.com *.livehelpnow.net *.oppwa.com *.contentsquare.com *.adyen.com x-apple-ql-id *.tinymce.com *.nexiopaysandbox.com *.acaptureservices.com app.tlinky.com

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: nonce-, self, sha384-, sha512-, sha256-

font-srcHIGH

'self' *.boxcdn.net fonts.gstatic.com *.flpqa.com *.ecpay.com.tw *.cdn01.boxcdn.net flpqa.com *.flptitanqa.com *.flpi.com *.s3.amazonaws.com flp360.social *.nextsphere.com ecpg-stage.ecpay.com.tw *.contentsquare.net foreverliving.com *.foreverliving.com 'unsafe-inline' oppwa.com *.flptitan.com *.b-cdn.net *.typekit.net *.bootstrapcdn.com *.clicktale.net *.flp.com *.cdn.jsdelivr.net flp.com *.myecheck.com *.ppipe.net *.box.com *.chargebee.com *.content-square.fr data: *.nexiopay.com cdnjs.cloudflare.com *.livehelpnow.net *.oppwa.com *.contentsquare.com *.cloudfront.net *.flp360.social

•Unsafe inline execution allowed in font-src

•Missing recommended values for font-src: self

connect-srcLOW

*.r2.dev 'self' *.userlike.com www.facebook.com dl.dropboxusercontent.com *.boxcdn.net *.worldpay.com *.googleapis.com *.s3-us-west-2.amazonaws.com *.s3.amazonaws.com *.flpi.com *.ecpay.com.tw ekr. google.com ecpg-stage.ecpay.com.tw blob: cdn-javascript.net *.foreverliving.com stats.g.doubleclick.net *.google.com *.socialsales.io *.ppipe.net *.1drv.com s3-us-west-2.amazonaws.com graph.microsoft.com *.livehelpnow.net *.s3.us-east-2.amazonaws.com *.cloudfront.net *.tinymce.com *.nexiopaysandbox.com *.acaptureservices.com *.youtube.com flp-service.zendesk.com *.s3-eu-west-1.amazonaws.com *.boxcloud.com *.fbo.foreverliving.com *.mgipayments.com foreverliving.com sp.tinymce.com api.trustbadge.etrusted.com cdn.tiny.cloud youtube.com *.clicktale.net zendesk-eu.my.sentry.io api.ipify.org tile.openstreetmap.org *.chargebee.com www.google.com.sg data: *.nexiopay.com *.consensu.org *.fbo.flptitan.com clickapp.net www.dropbox.com *.zdassets.com js.live.net wss://chat.userlike.com *.nextsphere.com *.authorize.net v2.zopim.com www.googletagmanager.com logging.trustbadge.com *.google-analytics.com *.gstatic.com *.flptitan.com *.tiny.cloud flptitan.com connect.facebook.net *.cookiefirst.com *.trustedshops.com *.myecheck.com js.hs-scripts.com *.box.com *.content-square.fr *.sharethis.com *.contentsquare.com *.adyen.com trustbadge.api.etrusted.com wss://api.smooch.io *.google.co.in *.contentsquare.net oppwa.com cdn.jsdelivr.net vimeo.com *.vimeocdn.com static-resource.com *.oppwa.com wss://umd.userlike.com *.s3.us-west-2.amazonaws.com *.basemaps.cartocdn.com app.tlinky.com

•Missing recommended values for connect-src: self

media-srcLOW

'self' *.userlike.com *.youtu.be blob: *.boxcdn.net *.amazonaws.com *.cloudfront.net *.youtube.com *.foreverliving.com *.s3-us-west-2.amazonaws.com *.s3.us-west-2.amazonaws.com *.flptitan.com app.tlinky.com

•Missing recommended values for media-src: self

frame-srcLOW

*.r2.dev 'self' *.userlike.com *.boxcdn.net *.datatrans.com dl.dropboxusercontent.com *.youtube.com *.worldpay.com *.clicksafe.lloydstsb.com content.googleapis.com youtu.be *.boxcloud.com *.flpqa.com *.flpi.com *.mgipayments.com *.nextsphere.com *.contentsquare.net foreverliving.com *.ngenius-payments.com *.sandbox.ngenius-payments.com www.googletagmanager.com *.foreverliving.com *.acehubpaymentservices.com oppwa.com *.flptitan.com *.google.com flptitan.com vimeo.com *.socialsales.io acs-public.tp.mastercard.com youtube.com *.amazonaws.com socialsales.io *.mgr.consensu.org walls.io *.ppipe.net *.myecheck.com *.facebook.com *.vimeo.com *.mfgroup.ch *.chargebee.com *.content-square.fr graph.microsoft.com *.nexiopay.com *.sharethis.com *.livehelpnow.net *.oppwa.com *.contentsquare.com *.cardinalcommerce.com *.adyen.com x-apple-ql-id *.cloudfront.net *.nexiopaysandbox.com *.acaptureservices.com app.tlinky.com

•Missing recommended values for frame-src: self

frame-ancestorsLOW

'self' *.boxcdn.net *.youtube.com *.worldpay.com youtu.be *.flpqa.com flpqa.com flp360.social foreverliving.com *.contentsquare.net *.foreverliving.com *.flptitan.com:8080 *.flptitan.com flptitan.com vimeo.com *.socialsales.io youtube.com socialsales.io *.flp.com flp.com *.flp360.social *.vimeo.com *.chargebee.com *.content-square.fr *.nexiopay.com *.contentsquare.com *.nexiopaysandbox.com app.tlinky.com

•Missing recommended values for frame-ancestors: none, self

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"

✓Strict-Transport-SecurityPresent

max-age=31536000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✗X-Frame-OptionsMissing

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

How to add it:

nginx

add_header X-Frame-Options "DENY" always;

apache

Header always set X-Frame-Options "DENY"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on foreverliving.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about foreverliving.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

foreverliving.lt

2 scans since 7/16/2025

Latest: 70/100

Total Scans

Latest Score

70/100

First Scan

7/16/2025

Last Scan

7/16/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 16, 2025	B (70)	No	3/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for foreverliving.lt

HTML

<a href="https://headertest.com/results/foreverliving.lt" title="Security headers grade for foreverliving.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/foreverliving.lt" alt="HeaderTest security grade: B (70/100) for foreverliving.lt" />
</a>

Markdown

[![HeaderTest security grade: B (70/100) for foreverliving.lt](https://headertest.com/api/badge/foreverliving.lt)](https://headertest.com/results/foreverliving.lt)