initec.ee
Grade A+ · 90/100 · 5/6 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
CSP Analysis
default-src 'self'; connect-src 'self' http://ad.doubleclick.net https://*.analytics.google.com https://*.api.userway.org https://*.botframework.com https://*.clarity.ms https://*.demandbase.com https://*.demdex.net https://*.eset.com https://*.googlesyndication.com https://*.hotjar.com https://*.hotjar.io https://*.tawk.to https://*.tt.omtrdc.net https://ads.reddit.com https://adservice.google.com https://analytics.google.com https://analytics.twitter.com https://api-preview.luckyorange.com https://api.company-target.com https://api.userway.org https://app2.salesmanago.pl https://bat.bing.com https://bat.bing.net https://c.go-mpulse.net https://cc.eset.ee https://cc.shop.eset.ee https://cdn.acsbapp.com https://cdn.linkedin.oribi.io https://cdn1.esetstatic.com https://conversions-config.reddit.com https://cookies-data.onetrust.io https://ep.smct.co https://eset.tt.omtrdc.net https://geolocation.onetrust.com https://googleads.g.doubleclick.net https://grsm.io https://ipb.smct.co https://ipb.smct.io https://js.smct.co https://js.smct.io https://maps.googleapis.com https://partnerlinks.io https://pixel-config.reddit.com https://privacyportal.onetrust.com https://px.ads.linkedin.com https://realtime.luckyorange.com https://region1.google-analytics.com https://replay.uxtweak.com https://s.yimg.com https://script.crazyegg.com https://segments.company-target.com https://settings.luckyorange.com https://settings.luckyorange.net https://smct.co https://stats.g.doubleclick.net https://tracker.clickguard.com https://tracking-api.g2.com https://www.facebook.com https://www.google-analytics.com https://www.google.by https://www.google.co.uz https://www.google.com https://www.google.es https://www.google.ie https://www.google.kg https://www.google.kz https://www.google.lt https://www.google.lv https://www.google.ru https://www.googleadservices.com https://www.googletagmanager.com https://www.redditstatic.com wss://*.botframework.com wss://*.eset.com wss://*.hotjar.com wss://*.tawk.to; font-src 'self' data: https://*.eset.com https://*.gstatic.com https://*.web-assets.eset.com https://cdn.userway.org https://embed.tawk.to https://fonts.smct.co https://fonts.smct.io https://script.hotjar.com; form-action 'self' https://*.eset-la.com https://*.eset.com https://*.form.eset.com https://*.tienda.eset-la.com https://s1069307879.t.eloqua.com https://webto.salesforce.com https://www.facebook.com; frame-ancestors 'self' https://*.eset.com; frame-src 'self' https://*.eset.com https://*.fls.doubleclick.net https://*.sgtm.eset.com https://8117415.fls.doubleclick.net https://bid.g.doubleclick.net https://eset.demdex.net https://hemsync.clickagy.com https://int.form.eset.com https://js.smct.io https://ls.smct.co https://maps.google.com https://s.company-target.com https://smct.co https://td.doubleclick.net https://tpc.googlesyndication.com https://unity.survey-solutions.cloud https://vars.hotjar.com https://widget.trustpilot.com https://www.facebook.com https://www.google.com https://www.googletagmanager.com https://www.youtube-nocookie.com https://www.youtube.com; img-src 'self' data: http://ad.doubleclick.net https://*.adform.net https://*.ads.linkedin.com https://*.eset.com https://*.hotjar.com https://*.rlcdn.com https://*.tawk.to https://*.yahoo.co.jp https://ad.doubleclick.net https://ade.googlesyndication.com https://adservice.google.com https://alb.reddit.com https://analytics.google.com https://analytics.twitter.com https://app2.salesmanago.pl https://bat.bing.com https://bat.bing.net https://c.bing.com https://c.clarity.ms https://cdn.esetstatic.com https://cdn.jsdelivr.net https://cdn.smct.co https://cdn.smct.io https://cdn1.esetstatic.com https://cm.everesttech.net https://cm.g.doubleclick.net https://connect.facebook.net https://dc.ads.linkedin.com https://dpm.demdex.net https://events.smct.co https://googleads.g.doubleclick.net https://i.ytimg.com https://images.g2crowd.com https://maps.googleapis.com https://pagead2.googlesyndication.com https://pubads.g.doubleclick.net https://px.ads.linkedin.com https://region1.analytics.google.com https://region1.google-analytics.com https://s1069307879.t.eloqua.com https://ssl.google-analytics.com https://stats.g.doubleclick.net https://t.co https://tribl.io https://web-assets.esetstatic.com https://www.facebook.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.linkedin.com; manifest-src 'self' https://*.eset.com https://*.web-assets.eset.com; media-src 'self' https://*.eset.com https://*.web-assets.eset.com https://api.userway.org https://cdn.userway.org https://embed.tawk.to; object-src 'self' https://*.eset.com https://*.web-assets.eset.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.eset.com https://*.luckyorange.com https://*.replay.uxtweak.com https://*.salesforceliveagent.com https://*.web-assets.eset.com https://acsbap.com https://acsbapp.com https://app2.salesmanago.pl https://assets.esetstatic.com https://bat.bing.com https://cdn.botframework.com https://cdn.esetstatic.com https://cdn.jsdelivr.net https://cdn.linkedin.oribi.io https://cdn.userway.org https://cdn1.esetstatic.com https://cdnjs.cloudflare.com https://connect.facebook.net https://d.la1-c2-cdg.salesforceliveagent.com https://embed.tawk.to https://googleads.g.doubleclick.net https://img06.en25.com https://invitejs.trustpilot.com https://js.partnerstack.com https://js.smct.co https://js.smct.io https://maps.googleapis.com https://pagead2.googlesyndication.com https://platform.twitter.com https://s786665.t.eloqua.com https://script.hotjar.com https://smct.co https://snap.licdn.com https://ssl.google-analytics.com https://static.ads-twitter.com https://static.hotjar.com https://tag.demandbase.com https://tpc.googlesyndication.com https://tracking-api.g2.com https://tribl.io https://widget.trustpilot.com https://www.clarity.ms https://www.google-analytics.com https://www.google.ae https://www.google.am https://www.google.be https://www.google.bg https://www.google.bs https://www.google.by https://www.google.cg https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.co.id https://www.google.co.il https://www.google.co.ke https://www.google.co.ma https://www.google.co.nz https://www.google.co.th https://www.google.co.uz https://www.google.co.ve https://www.google.co.zw https://www.google.com https://www.google.dj https://www.google.dz https://www.google.ee https://www.google.es https://www.google.fi https://www.google.ge https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.md https://www.google.me https://www.google.mk https://www.google.ps https://www.google.pt https://www.google.ro https://www.google.ru https://www.google.se https://www.google.si https://www.google.tn https://www.googleadservices.com https://www.googleoptimize.com https://www.googletagmanager.com https://www.gstatic.com https://www.redditstatic.com https://www.youtube.com; style-src 'self' 'unsafe-inline' https://*.eset.com https://*.hotjar.com https://*.tawk.to https://*.web-assets.eset.com https://cdn.esetstatic.com https://cdn.jsdelivr.net https://fonts.smct.co https://fonts.smct.io; worker-src 'self' https://*.eset.com; report-uri https://www-eset-com.api.cspconsole.com/v1/reports; report-to csp-endpoint;
Directive Analysis
Security Headers
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valueno-referrer-when-downgrade
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
max-age=31536000
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
1; mode=block; report=https://eset.report-uri.com/r/d/xss/enforce
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on initec.ee.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
initec.ee
3 scans since 7/18/2025
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/18/2025
Last Scan
7/18/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/initec.ee" title="Security headers grade for initec.ee — HeaderTest">
<img src="https://headertest.com/api/badge/initec.ee" alt="HeaderTest security grade: A+ (90/100) for initec.ee" />
</a>[](https://headertest.com/results/initec.ee)