Domain History
helis.lt
Grade C · 60/100 · 2/6 security headers present
Security Score
C
60/ 100
Security Headers
2/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
report-uri https://sentry.eneba.com/api/6/security/?sentry_key=102de17feb49405fadcbb032c33331d1&sentry_release=1.3128.1; report-to csp-endpoint; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.googleadservices.com https://www.google.com https://pagead2.googlesyndication.com https://googleads.g.doubleclick.net https://*.nsureapi.com https://device.maxmind.com https://fpnpmcdn.net https://static.hotjar.com https://script.hotjar.com https://connect.facebook.net https://eneba.atlassian.net https://static.eneba.games https://assets.eneba.games https://challenges.cloudflare.com https://mx.eneba.com https://*.criteo.net https://*.criteo.com https://mainf.global-cache.online https://widget.trustpilot.com https://apps.rokt.com https://js.braintreegateway.com https://assets.braintreegateway.com https://www.paypalobjects.com https://www.paypal.com https://c.paypal.com https://*.cardinalcommerce.com https://*.js.stripe.com https://js.stripe.com https://checkoutshopper-live-us.adyen.com https://checkoutshopper-live.adyen.com https://cdn.safecharge.com https://pay.google.com https://static.dlocal.com https://ebanx-js.ebanx.com https://beacon.riskified.com https://i.k-analytix.com https://cdn.checkout.com https://applepay.cdn-apple.com https://js.tazapay.com;
Directive Analysis
report-uriLOW
https://sentry.eneba.com/api/6/security/?sentry_key=102de17feb49405fadcbb032c33331d1&sentry_release=1.3128.1
report-toLOW
csp-endpoint
script-srcHIGH
'self' https://*.js.stripe.com https://js.stripe.com https://static.dlocal.com https://widget.trustpilot.com https://applepay.cdn-apple.com https://static.eneba.games https://cdn.safecharge.com https://pay.google.com https://www.paypalobjects.com https://js.braintreegateway.com https://*.cardinalcommerce.com https://eneba.atlassian.net 'unsafe-eval' https://checkoutshopper-live-us.adyen.com https://www.googletagmanager.com https://googleads.g.doubleclick.net https://connect.facebook.net https://script.hotjar.com https://static.hotjar.com https://checkoutshopper-live.adyen.com https://fpnpmcdn.net https://www.googleadservices.com https://assets.braintreegateway.com https://www.paypal.com https://pagead2.googlesyndication.com https://js.tazapay.com https://*.nsureapi.com https://c.paypal.com https://*.criteo.com https://mainf.global-cache.online https://device.maxmind.com https://assets.eneba.games https://i.k-analytix.com https://*.criteo.net https://www.google.com https://beacon.riskified.com https://ebanx-js.ebanx.com https://apps.rokt.com 'unsafe-inline' https://challenges.cloudflare.com https://mx.eneba.com https://cdn.checkout.com
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: sha512-, nonce-, self, sha384-, sha256-
•No nonces or hashes used for script-src
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
no-referrer-when-downgrade
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✗Strict-Transport-SecurityMissing
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
How to add it:
nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"cloudflare
SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)✗X-Content-Type-OptionsMissing
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
How to add it:
nginx
add_header X-Content-Type-Options "nosniff" always;apache
Header always set X-Content-Type-Options "nosniff"cloudflare
Rules > Transform Rules > Managed Transforms > Enable "Add X-Content-Type-Options header"✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✗X-XSS-ProtectionMissing
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
How to add it:
nginx
add_header X-XSS-Protection "0" always;apache
Header always set X-XSS-Protection "0"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-XSS-Protection to "0"4 recommended security headers are missing on helis.lt.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about helis.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
helis.lt
2 scans since 7/16/2025
C
Latest: 60/100
Total Scans
2
Latest Score
60/100
First Scan
7/16/2025
Last Scan
7/16/2025
Scan History
| Date | Score | CSP | Headers | Issues | Action |
|---|---|---|---|---|---|
| Jul 16, 2025 | C (60) | No | 2/6 | 0 | View → |
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/helis.lt" title="Security headers grade for helis.lt — HeaderTest">
<img src="https://headertest.com/api/badge/helis.lt" alt="HeaderTest security grade: C (60/100) for helis.lt" />
</a>Markdown
[](https://headertest.com/results/helis.lt)