Domain History

ilon.ee

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+

90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://fonts.googleapis.com https://maps.googleapis.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://*.googleusercontent.com s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com i.ytimg.com www.googletagmanager.com; connect-src 'self' *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com www.googletagmanager.com; font-src 'self' data: https://fonts.gstatic.com data: fonts.gstatic.com fonts.googleapis.com; frame-src 'self' https://www.google.com https://www.google.com/maps *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; upgrade-insecure-requests; block-all-mixed-content; report-uri https://salm.ee?gdsih-csp-report;

Directive Analysis

default-srcHIGH

'unsafe-eval' 'unsafe-inline' data: 'self'

•Unsafe eval() execution allowed in default-src

•Unsafe inline execution allowed in default-src

•Missing recommended values for default-src: self

script-srcHIGH

adservice.google.fr googletagmanager.com adservice.google.bs adservice.google.gr adservice.google.com.br ajax.googleapis.com adservice.google.com.mm adservice.google.com.pe adservice.google.is adservice.google.com.sv adservice.google.com.kw adservice.google.gy tagmanager.google.com adservice.google.co.il 'self' adservice.google.im adservice.google.lv adservice.google.co.ke adservice.google.co.tz adservice.google.sk adservice.google.com.hk adservice.google.com.bn stats.g.doubleclick.net adservice.google.hr adservice.google.co.uz adservice.google.md adservice.google.com.uy adservice.google.se adservice.google.co.uk adservice.google.so adservice.google.com.fj adservice.google.kz adservice.google.co.in adservice.google.com.qa adservice.google.dk adservice.google.bg 'unsafe-eval' adservice.google.com.pk adservice.google.com.np 'unsafe-inline' adservice.google.ae adservice.google.jo adservice.google.tn adservice.google.com.om adservice.google.ie adservice.google.li adservice.google.tt adservice.google.com.py adservice.google.ch adservice.google.cl adservice.google.rs adservice.google.it adservice.google.co.zm adservice.google.com.ec adservice.google.co.ve adservice.google.cz adservice.google.com.ua www.googletagservices.com adservice.google.mk adservice.google.ru adservice.google.com.co adservice.google.com.bo adservice.google.sr maps.googleapis.com adservice.google.com.pr https://maps.googleapis.com adservice.google.com.ai *.googlesyndication.com adservice.google.no adservice.google.com.jm adservice.google.co.jp adservice.google.com.ng *.googleadservices.com adservice.google.com.my adservice.google.com.sa adservice.google.com.tw adservice.google.ee adservice.google.hn adservice.google.pt adservice.google.com.bh adservice.google.nl adservice.google.com.mx adservice.google.dz adservice.google.at adservice.google.com.sg adservice.google.be https://maps.gstatic.com adservice.google.al adservice.google.com.kh adservice.google.lu maps.google.com adservice.google.com.gt adservice.google.com.gi adservice.google.co.nz adservice.google.co.mz adservice.google.fi adservice.google.si adservice.google.co.zw adservice.google.tl adservice.google.co.za adservice.google.com.bd www.googletagmanager.com adservice.google.ca adservice.google.co.th adservice.google.com.lb www.google-analytics.com adservice.google.com.tr adservice.google.com.et adservice.google.lk adservice.google.com.au adservice.google.ci adservice.google.com.ar ssl.google-analytics.com google-analytics.com adservice.google.com adservice.google.co.cr adservice.google.com.cy adservice.google.es adservice.google.com.ph adservice.google.com.gh adservice.google.mu adservice.google.pl adservice.google.ro adservice.google.de adservice.google.lt adservice.google.hu adservice.google.co.bw adservice.google.com.eg adservice.google.iq adservice.google.com.vn adservice.google.ge adservice.google.co.kr adservice.google.com.mt adservice.google.co.id adservice.google.com.ni adservice.google.com.pa googleads.g.doubleclick.net

•Unsafe eval() execution allowed in script-src

•Unsafe inline execution allowed in script-src

•Missing recommended values for script-src: nonce-, self, sha256-, sha384-, sha512-

•No nonces or hashes used for script-src

style-srcHIGH

fonts.googleapis.com data: 'unsafe-inline' maps.google.com https://maps.googleapis.com https://fonts.googleapis.com tagmanager.google.com www.googletagmanager.com maps.googleapis.com 'self'

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: nonce-, self, sha256-, sha384-, sha512-

img-srcLOW

www.google.com www.google-analytics.com https://maps.googleapis.com www.gstatic.com https://*.googleusercontent.com 'self' *.googlesyndication.com s.w.org ssl.google-analytics.com google-analytics.com www.gravatar.com ts.w.org *.ggpht.com blob: *.googleapis.com i.ytimg.com ps.w.org stats.g.doubleclick.net secure.gravatar.com https://maps.gstatic.com data: maps.gstatic.com maps.google.com www.googletagmanager.com

•Missing recommended values for img-src: self

connect-srcLOW

*.googlesyndication.com analytics.google.com maps.google.com www.google-analytics.com stats.g.doubleclick.net ampcid.google.com about: www.googletagmanager.com maps.googleapis.com googleads.g.doubleclick.net 'self'

•Missing recommended values for connect-src: self

font-srcLOW

fonts.googleapis.com data: fonts.gstatic.com https://fonts.gstatic.com 'self'

•Missing recommended values for font-src: self

frame-srcLOW

*.googlesyndication.com www.youtube.com maps.google.com https://www.google.com https://www.google.com/maps www.googletagmanager.com maps.googleapis.com googleads.g.doubleclick.net 'self'

•Missing recommended values for frame-src: self

child-srcLOW

www.googletagmanager.com www.youtube.com 'self'

•Unknown directive: child-src

upgrade-insecure-requestsLOW

block-all-mixed-contentLOW

report-uriLOW

https://salm.ee?gdsih-csp-report

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block;

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on ilon.ee.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about ilon.eeWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

ilon.ee

2 scans since 7/18/2025

A+

Latest: 90/100

Total Scans

Latest Score

90/100

First Scan

7/18/2025

Last Scan

7/18/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 18, 2025	A+ (90)	No	5/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for ilon.ee

HTML

<a href="https://headertest.com/results/ilon.ee" title="Security headers grade for ilon.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/ilon.ee" alt="HeaderTest security grade: A+ (90/100) for ilon.ee" />
</a>

Markdown

[![HeaderTest security grade: A+ (90/100) for ilon.ee](https://headertest.com/api/badge/ilon.ee)](https://headertest.com/results/ilon.ee)