Domain History

herbalife.lt

Grade B · 70/100 · 3/6 security headers present

Security Score

70/ 100

Security Headers

0/ 3

CSP Violations

NoViolations

Issues Found

16Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src 'self'; base-uri 'self'; manifest-src 'self'; media-src 'self'; script-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru www.googleadservices.com *.g.doubleclick.net www.googletagmanager.com www.googleoptimize.com ad.adriver.ru antifraud.acstat.com assets.adobedtm.com cm.everesttech.net cdn.cookielaw.org code.acstat.com https://connect.facebook.net dmp.vihub.ru https://herbalife.ramfy.ru/push/lk5119mvfjcaa.js pix.sniperlog.ru pixel.betweenx.com tags.soloway.ru/DSPCounter.js top-fwz1.mail.ru https://vk.com/js/api/openapi.js www.clarity.ms cdnjs.cloudflare.com bitrix.info 'strict-dynamic' 'nonce-uuvwi4pasivyjo9k3kif'; style-src 'self' 'unsafe-inline' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru assets.adobedtm.com optanon.blob.core.windows.net; connect-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru www.googleadservices.com *.g.doubleclick.net www.googletagmanager.com www.googleoptimize.com cdn.cookielaw.org assets.adobedtm.com privacyportal.onetrust.com geolocation.onetrust.com top-fwz1.mail.ru privacy-cs.mail.ru pixel.betweenx.com trc.taboola.com *.clarity.ms ev.adriver.ru content.adriver.ru dpm.demdex.net smetrics.herbalife.com metrics.herbalife.com c.bing.com herbalife.tt.omtrdc.net dmp.vihub.ru ad.adriver.ru https://smartcaptcha.yandexcloud.net bitrix.info; font-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru; frame-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru www.youtube.com content.adriver.ru td.doubleclick.net partners.cpaex.ru herbalife.demdex.net ad.adriver.ru https://smartcaptcha.yandexcloud.net; child-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru www.youtube.com content.adriver.ru td.doubleclick.net partners.cpaex.ru herbalife.demdex.net ad.adriver.ru https://smartcaptcha.yandexcloud.net; img-src 'self' *.google.com *.google.ru *.googleapis.com *.gstatic.com www.google-analytics.com yandex.ru *.yandex.ru *.yandex.md yastatic.net *.yandex.net cdn.jsdelivr.net leads.herbalife.ru ad.adriver.ru ev.adriver.ru assets.adobedtm.com hit.acstat.com x01.aidata.io px.adhigh.net sync.1dmp.io sync.bumlam.com sync.videonow.ru dmp.vihub.ru tms.dmp.wi-fi.ru trc.taboola.com vk.com c.clarity.ms c.bing.com region1.google-analytics.com www.facebook.com googleads.g.doubleclick.net https://www.googletagmanager.com i.ytimg.com metrics.herbalife.com cm.everesttech.net herbalife.ru top-fwz1.mail.ru dpm.demdex.net ads.adfox.ru herbalife-breakfast.com smetrics.herbalife.com data:; object-src 'none';

Directive Analysis

default-srcLOW

'self'

•Missing recommended values for default-src: self

base-uriLOW

'self'

•Missing recommended values for base-uri: self, none

manifest-srcLOW

'self'

•Missing recommended values for manifest-src: self

media-srcLOW

'self'

•Missing recommended values for media-src: self

script-srcMEDIUM

cm.everesttech.net cdnjs.cloudflare.com dmp.vihub.ru *.google.ru bitrix.info https://connect.facebook.net www.google-analytics.com cdn.cookielaw.org *.yandex.ru pix.sniperlog.ru *.googleapis.com antifraud.acstat.com www.googleadservices.com www.googletagmanager.com https://vk.com/js/api/openapi.js assets.adobedtm.com code.acstat.com *.gstatic.com https://herbalife.ramfy.ru/push/lk5119mvfjcaa.js *.google.com pixel.betweenx.com leads.herbalife.ru www.clarity.ms *.yandex.net tags.soloway.ru/DSPCounter.js yandex.ru 'self' yastatic.net cdn.jsdelivr.net www.googleoptimize.com *.g.doubleclick.net 'nonce-uuvwi4pasivyjo9k3kif' ad.adriver.ru 'strict-dynamic' top-fwz1.mail.ru *.yandex.md

•Missing recommended values for script-src: nonce-, sha256-, sha384-, sha512-, self

•No nonces or hashes used for script-src

style-srcHIGH

'unsafe-inline' yandex.ru 'self' *.gstatic.com yastatic.net cdn.jsdelivr.net *.google.ru *.yandex.ru *.google.com *.googleapis.com leads.herbalife.ru *.yandex.net assets.adobedtm.com *.yandex.md optanon.blob.core.windows.net www.google-analytics.com

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: nonce-, sha256-, sha384-, sha512-, self

connect-srcLOW

ev.adriver.ru dmp.vihub.ru *.google.ru geolocation.onetrust.com bitrix.info www.google-analytics.com cdn.cookielaw.org smetrics.herbalife.com dpm.demdex.net *.yandex.ru trc.taboola.com *.googleapis.com *.clarity.ms www.googleadservices.com www.googletagmanager.com assets.adobedtm.com *.gstatic.com privacyportal.onetrust.com privacy-cs.mail.ru *.google.com metrics.herbalife.com pixel.betweenx.com leads.herbalife.ru *.yandex.net herbalife.tt.omtrdc.net yandex.ru 'self' yastatic.net cdn.jsdelivr.net content.adriver.ru www.googleoptimize.com *.g.doubleclick.net ad.adriver.ru c.bing.com top-fwz1.mail.ru *.yandex.md https://smartcaptcha.yandexcloud.net

•Missing recommended values for connect-src: self

font-srcLOW

yandex.ru 'self' *.gstatic.com yastatic.net cdn.jsdelivr.net *.google.ru *.yandex.ru *.google.com *.googleapis.com leads.herbalife.ru *.yandex.net *.yandex.md www.google-analytics.com

•Missing recommended values for font-src: self

frame-srcLOW

*.google.ru www.youtube.com herbalife.demdex.net www.google-analytics.com *.yandex.ru *.googleapis.com *.gstatic.com *.google.com leads.herbalife.ru *.yandex.net yandex.ru 'self' yastatic.net cdn.jsdelivr.net content.adriver.ru ad.adriver.ru partners.cpaex.ru td.doubleclick.net *.yandex.md https://smartcaptcha.yandexcloud.net

•Missing recommended values for frame-src: self

child-srcLOW

•Unknown directive: child-src

img-srcLOW

cm.everesttech.net ev.adriver.ru sync.bumlam.com *.google.ru dmp.vihub.ru data: tms.dmp.wi-fi.ru ads.adfox.ru www.facebook.com www.google-analytics.com sync.videonow.ru smetrics.herbalife.com dpm.demdex.net *.yandex.ru trc.taboola.com *.googleapis.com vk.com herbalife.ru assets.adobedtm.com sync.1dmp.io region1.google-analytics.com hit.acstat.com i.ytimg.com *.gstatic.com googleads.g.doubleclick.net x01.aidata.io *.google.com metrics.herbalife.com c.clarity.ms leads.herbalife.ru *.yandex.net herbalife-breakfast.com yandex.ru 'self' yastatic.net cdn.jsdelivr.net ad.adriver.ru c.bing.com px.adhigh.net top-fwz1.mail.ru *.yandex.md https://www.googletagmanager.com

•Missing recommended values for img-src: self

object-srcLOW

'none'

•Missing recommended values for object-src: none

Security Headers

✗Strict-Transport-SecurityMissing

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

How to add it:

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

cloudflare

SSL/TLS > Edge Certificates > Enable HSTS (toggle on, set max-age to 12 months, enable includeSubDomains)

✗X-Content-Type-OptionsMissing

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

How to add it:

nginx

add_header X-Content-Type-Options "nosniff" always;

apache

Header always set X-Content-Type-Options "nosniff"

cloudflare

Rules > Transform Rules > Managed Transforms > Enable "Add X-Content-Type-Options header"

✗X-Frame-OptionsMissing

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

How to add it:

nginx

add_header X-Frame-Options "DENY" always;

apache

Header always set X-Frame-Options "DENY"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"

3 recommended security headers are missing on herbalife.lt.

Issues Found

•Missing recommended values for default-src: self
•Missing recommended values for base-uri: self, none
•Missing recommended values for manifest-src: self
•Missing recommended values for media-src: self
•Missing recommended values for script-src: nonce-, sha256-, sha384-, sha512-, self
•No nonces or hashes used for script-src
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: nonce-, sha256-, sha384-, sha512-, self
•Missing recommended values for connect-src: self
•Missing recommended values for font-src: self
•Missing recommended values for frame-src: self
•Unknown directive: child-src
•Missing recommended values for img-src: self
•Missing recommended values for object-src: none
•Missing critical directive frame-ancestors (Framing control)
•Missing critical directive sandbox (Content isolation)

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about herbalife.lt

See full exposure report on OSN →Free, no signup.

herbalife.lt

1 scan since 7/12/2025

Latest: 70/100

Total Scans

Latest Score

70/100

First Scan

7/12/2025

Last Scan

7/12/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 12, 2025	B (70)	Yes	3/6	16	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: B (70/100) for herbalife.lt

HTML

<a href="https://headertest.com/results/herbalife.lt" title="Security headers grade for herbalife.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/herbalife.lt" alt="HeaderTest security grade: B (70/100) for herbalife.lt" />
</a>

Markdown

[![HeaderTest security grade: B (70/100) for herbalife.lt](https://headertest.com/api/badge/herbalife.lt)](https://headertest.com/results/herbalife.lt)