Domain History
haapsalulinnus.ee
Grade A+ · 90/100 · 5/6 security headers present
Security Score
A+
90/ 100
Security Headers
5/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://fonts.googleapis.com https://maps.googleapis.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://*.googleusercontent.com s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com i.ytimg.com www.googletagmanager.com; connect-src 'self' *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com www.googletagmanager.com; font-src 'self' data: https://fonts.gstatic.com data: fonts.gstatic.com fonts.googleapis.com; frame-src 'self' https://www.google.com https://www.google.com/maps *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; upgrade-insecure-requests; block-all-mixed-content; report-uri https://salm.ee?gdsih-csp-report;
Directive Analysis
default-srcHIGH
'unsafe-eval' 'unsafe-inline' data: 'self'
•Unsafe eval() execution allowed in default-src
•Unsafe inline execution allowed in default-src
•Missing recommended values for default-src: self
script-srcHIGH
adservice.google.com.lb adservice.google.de adservice.google.com.fj adservice.google.se adservice.google.com.vn adservice.google.co.il adservice.google.li googletagmanager.com adservice.google.com.ar adservice.google.com.hk adservice.google.pt adservice.google.iq adservice.google.so adservice.google.co.in adservice.google.com.sa adservice.google.fi adservice.google.dz adservice.google.com.bh adservice.google.co.ke adservice.google.com.ua adservice.google.dk adservice.google.com.mm adservice.google.com.qa adservice.google.com.tw adservice.google.com.et adservice.google.sr ssl.google-analytics.com adservice.google.com.eg adservice.google.com.au adservice.google.es adservice.google.co.mz adservice.google.com.ai adservice.google.com.gt adservice.google.co.kr tagmanager.google.com adservice.google.ge adservice.google.co.bw 'self' maps.googleapis.com adservice.google.com.ec www.google-analytics.com adservice.google.com.mx adservice.google.com.gh adservice.google.co.uz adservice.google.co.tz adservice.google.com.kw adservice.google.is ajax.googleapis.com adservice.google.com.mt adservice.google.ch adservice.google.co.zw adservice.google.com.ni adservice.google.com.pr adservice.google.jo adservice.google.ae adservice.google.be adservice.google.com.jm adservice.google.com.py adservice.google.rs adservice.google.bs adservice.google.com.uy adservice.google.lt maps.google.com www.googletagmanager.com adservice.google.cz adservice.google.sk adservice.google.co.zm adservice.google.ru adservice.google.com.co https://maps.gstatic.com https://maps.googleapis.com adservice.google.kz adservice.google.tt stats.g.doubleclick.net adservice.google.co.cr adservice.google.com.cy adservice.google.gy adservice.google.pl adservice.google.com.om adservice.google.im googleads.g.doubleclick.net 'unsafe-eval' adservice.google.tl adservice.google.com.gi adservice.google.co.nz adservice.google.mk adservice.google.co.id adservice.google.lu adservice.google.com.pe adservice.google.ca adservice.google.com google-analytics.com adservice.google.nl adservice.google.no adservice.google.hr adservice.google.gr adservice.google.tn adservice.google.ee adservice.google.com.bo adservice.google.ci adservice.google.com.bn adservice.google.com.pa adservice.google.co.ve adservice.google.hn adservice.google.md adservice.google.si www.googletagservices.com adservice.google.cl adservice.google.ie adservice.google.bg adservice.google.co.jp *.googleadservices.com adservice.google.com.pk adservice.google.com.sv adservice.google.com.np adservice.google.co.uk *.googlesyndication.com adservice.google.com.sg adservice.google.mu adservice.google.at adservice.google.co.za adservice.google.com.br 'unsafe-inline' adservice.google.al adservice.google.lk adservice.google.com.bd adservice.google.com.my adservice.google.lv adservice.google.com.ph adservice.google.com.ng adservice.google.com.kh adservice.google.it adservice.google.co.th adservice.google.hu adservice.google.fr adservice.google.ro adservice.google.com.tr
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: sha512-, sha256-, sha384-, nonce-, self
•No nonces or hashes used for script-src
style-srcHIGH
fonts.googleapis.com 'unsafe-inline' maps.google.com https://maps.googleapis.com tagmanager.google.com data: maps.googleapis.com 'self' www.googletagmanager.com https://fonts.googleapis.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha512-, sha256-, sha384-, nonce-, self
img-srcLOW
https://maps.gstatic.com https://maps.googleapis.com s.w.org data: 'self' stats.g.doubleclick.net ps.w.org www.google-analytics.com *.googlesyndication.com *.googleapis.com ts.w.org www.gravatar.com *.ggpht.com secure.gravatar.com google-analytics.com www.gstatic.com i.ytimg.com blob: maps.gstatic.com maps.google.com ssl.google-analytics.com www.googletagmanager.com www.google.com https://*.googleusercontent.com
•Missing recommended values for img-src: self
connect-srcLOW
googleads.g.doubleclick.net maps.google.com ampcid.google.com analytics.google.com about: maps.googleapis.com 'self' stats.g.doubleclick.net www.googletagmanager.com www.google-analytics.com *.googlesyndication.com
•Missing recommended values for connect-src: self
font-srcLOW
fonts.googleapis.com data: 'self' fonts.gstatic.com https://fonts.gstatic.com
•Missing recommended values for font-src: self
frame-srcLOW
googleads.g.doubleclick.net maps.google.com https://www.google.com maps.googleapis.com 'self' https://www.google.com/maps www.googletagmanager.com www.youtube.com *.googlesyndication.com
•Missing recommended values for frame-src: self
child-srcLOW
www.googletagmanager.com 'self' www.youtube.com
•Unknown directive: child-src
upgrade-insecure-requestsLOW
block-all-mixed-contentLOW
report-uriLOW
https://salm.ee?gdsih-csp-report
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
no-referrer-when-downgrade
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubDomains
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block;
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on haapsalulinnus.ee.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about haapsalulinnus.eeWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
haapsalulinnus.ee
3 scans since 7/18/2025
A+
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/18/2025
Last Scan
7/18/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/haapsalulinnus.ee" title="Security headers grade for haapsalulinnus.ee — HeaderTest">
<img src="https://headertest.com/api/badge/haapsalulinnus.ee" alt="HeaderTest security grade: A+ (90/100) for haapsalulinnus.ee" />
</a>Markdown
[](https://headertest.com/results/haapsalulinnus.ee)