Domain History
jameshardie.ee
Grade C · 60/100 · 2/6 security headers present
Security Score
C
60/ 100
Security Headers
2/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: jameshardie.at *.jameshardie.at jameshardie.be *.jameshardie.be jameshardie.ch *.jameshardie.ch jameshardie.cz *.jameshardie.cz jameshardie.de *.jameshardie.de jameshardie.dk *.jameshardie.dk jameshardie.ee *.jameshardie.ee jameshardie.es *.jameshardie.es jameshardie.eu *.jameshardie.eu jameshardie.fi *.jameshardie.fi jameshardie.fr *.jameshardie.fr jameshardie.it *.jameshardie.it jameshardie.lv *.jameshardie.lv jameshardie.nl *.jameshardie.nl jameshardie.pl *.jameshardie.pl jameshardie.se *.jameshardie.se jameshardie.co.uk *.jameshardie.co.uk fermacell.at *.fermacell.at fermacell.be *.fermacell.be fermacell.ch *.fermacell.ch fermacell.com *.fermacell.com fermacell.cz *.fermacell.cz fermacell.de *.fermacell.de fermacell.dk *.fermacell.dk fermacell.es *.fermacell.es fermacell.fr *.fermacell.fr fermacell.hr *.fermacell.hr fermacell.it *.fermacell.it fermacell.nl *.fermacell.nl fermacell.pl *.fermacell.pl fermacell.se *.fermacell.se fermacell.si *.fermacell.si fermacell.sk *.fermacell.sk fermacell.co.uk *.fermacell.co.uk aestuver.ch *.aestuver.ch aestuver.com *.aestuver.com aestuver.de *.aestuver.de *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat *.googleapis.com *.googlevideo.com *.youtube.com *.gstatic.com *.hotjar.com *.cloudfront.net oxomi.com https://james-hardie.prescreenapp.io https://james-hardie.bynder.com https://fermacell.omq.de https://pph20-fermacell.twt-clients.de https://james-hardie.onlyfy.jobs https://cdn.cookielaw.org https://www.googletagmanager.com https://www.facebook.com https://connect.facebook.net https://px.ads.linkedin.com https://snap.licdn.com https://static.doubleclick.net https://stats.g.doubleclick.net https://googleads.g.doubleclick.net https://i.ytimg.com https://yt3.ggpht.com https://privacyportal.onetrust.com https://script.crazyegg.com https://pi.pardot.com https://cdnjs.cloudflare.com https://code.jquery.com https://raw.githubusercontent.com https://cdn.polyfill.io https://bam.eu01.nr-data.net https://js-agent.newrelic.com https://www.heinze.de https://fonts.onlyfy.net https://content.prescreen.io https://ct.pinterest.com https://s.pinimg.com https://browser-update.org https://gitcdn.github.io https://maxcdn.bootstrapcdn.com https://hello.myfonts.net https://use.fontawesome.com https://*.paypal.com https://*.paypalobjects.com https://api.referenz-verwaltung.ch *.google-analytics.com pagead2.googlesyndication.com https://service.force.com https://jameshardieeurope--jhfull.sandbox.my.salesforce.com https://jameshardieeurope--jhfull.sandbox.my.site.com https://c.la12s-core1.sfdc-cehfhs.salesforceliveagent.com https://d.la12s-core1.sfdc-cehfhs.salesforceliveagent.com https://static.lightning.force.com *.sitebrunch.com
Directive Analysis
default-srcHIGH
jameshardie.nl *.google.co.ve jameshardie.se *.google.co.nz fermacell.de *.google.co.ug *.google.as *.google.com.mm *.google.ca *.google.ws *.google.nu *.google.com.pr *.google.cg *.google.com.ec *.google.ie *.google.je *.google.nl *.google.co.za *.google.ee *.google.co.uk aestuver.ch *.google.jo *.google.com.np aestuver.com *.google.com.sa *.google.co.ck *.jameshardie.dk *.google.tt *.google.co.zw *.google.co.kr https://*.paypalobjects.com *.google.com.bh *.youtube.com https://static.doubleclick.net *.fermacell.sk *.google.rs fermacell.pl *.google.lu fermacell.fr *.google.al *.google.dk jameshardie.eu *.google.sn *.google.bi *.fermacell.com *.hotjar.com *.google.pn *.google.com.ar *.google.com.om *.fermacell.nl *.google.com.et *.google.sk *.jameshardie.es *.google.cd *.google.ps *.google.com.ua *.google.com.na https://script.crazyegg.com *.google.com.ly jameshardie.cz *.google.com.bd *.google.com.gh *.google.com.uy *.google.cm https://browser-update.org *.fermacell.co.uk blob: *.fermacell.si *.google.com.sl *.fermacell.ch *.jameshardie.co.uk https://service.force.com *.google.com.cu *.google.td *.google.co.id *.google.com.lb *.google.lt https://www.googletagmanager.com https://static.lightning.force.com https://www.facebook.com *.google.com.my https://px.ads.linkedin.com https://snap.licdn.com *.google.ae *.aestuver.com https://pi.pardot.com https://cdn.polyfill.io jameshardie.fr *.google.com.bn *.fermacell.at *.jameshardie.eu *.google.pt jameshardie.it *.google.it *.google.bj *.google.tl *.fermacell.pl *.google.to *.google.com.sv *.jameshardie.be *.googleapis.com *.jameshardie.fi *.google.com.kw https://www.heinze.de *.fermacell.it *.google.com.py *.google.lk *.google.com.tj *.google.com.pa fermacell.si *.google.gr *.google.iq *.google.com.jm https://c.la12s-core1.sfdc-cehfhs.salesforceliveagent.com *.google.co.uz fermacell.cz *.google.so *.google.gg *.google.cf *.google.com.do *.google.gl *.jameshardie.at *.google.es *.sitebrunch.com *.google.com.cy *.google.sh *.google.at *.google.bf https://js-agent.newrelic.com jameshardie.fi *.google.com.pg fermacell.co.uk *.google.la *.google.dm *.google.ht https://stats.g.doubleclick.net *.google.bs *.google.cat https://hello.myfonts.net *.google.tn fermacell.se *.google.co.ls fermacell.hr *.google.me *.google.com.ng *.google.com.eg https://maxcdn.bootstrapcdn.com *.google.ad *.google.gy *.google.tg *.google.md https://pph20-fermacell.twt-clients.de *.google.com.sb *.google.ga *.google.li https://gitcdn.github.io *.google.sr *.google.bg *.google.sm https://googleads.g.doubleclick.net *.google.com.bo *.google.st fermacell.dk https://s.pinimg.com https://connect.facebook.net *.google.nr jameshardie.be https://james-hardie.onlyfy.jobs *.google.gm *.google.hn *.googlevideo.com *.google.ne *.google.mw *.google.com.qa *.google.com.ni *.google.mn *.google.co.tz fermacell.es *.fermacell.be *.google.com.au *.google.com.hk *.google.com.af https://*.paypal.com *.google.com.fj jameshardie.co.uk *.fermacell.fr *.google.am *.google.co.bw *.google.dj *.google.co.jp *.google.co.in *.google.si pagead2.googlesyndication.com https://cdnjs.cloudflare.com *.google.ba *.google.hu 'unsafe-inline' *.fermacell.hr *.google.com.ag *.jameshardie.cz fermacell.nl *.fermacell.cz 'self' *.google.com.pk *.google.mg *.google.is *.jameshardie.de https://api.referenz-verwaltung.ch https://james-hardie.prescreenapp.io *.google.com.vn *.google.com.vc *.jameshardie.nl *.google.cl *.google.bt https://content.prescreen.io *.google.ge *.google.tm jameshardie.lv *.google.lv fermacell.sk *.fermacell.se *.google.ru https://code.jquery.com *.google.fr https://privacyportal.onetrust.com *.jameshardie.pl *.google.kg *.google.com.tw https://jameshardieeurope--jhfull.sandbox.my.salesforce.com *.google.hr *.google.cn *.google.vu *.google.ch *.aestuver.ch https://ct.pinterest.com *.google.ki *.google.ci *.google.com.co *.google.com.br *.jameshardie.fr jameshardie.ch *.google.com.pe https://bam.eu01.nr-data.net https://d.la12s-core1.sfdc-cehfhs.salesforceliveagent.com *.google.az fermacell.be *.google.com.mx https://use.fontawesome.com *.jameshardie.lv *.google.se *.fermacell.dk *.google.kz jameshardie.es fermacell.at *.google.co.cr *.google.co.ma jameshardie.pl *.google.im *.google.no oxomi.com *.google.ro *.cloudfront.net data: *.google.com.mt *.google.sc *.google-analytics.com *.google.by *.google.com.kh fermacell.ch 'unsafe-eval' *.google.com.gt *.google.dz jameshardie.dk jameshardie.ee *.google.mk *.jameshardie.se *.google.com.ph *.google.co.ao https://fermacell.omq.de aestuver.de fermacell.it *.google.co.vi *.google.co.th *.jameshardie.it https://fonts.onlyfy.net *.google.pl *.aestuver.de *.google.com *.google.com.bz *.google.be *.google.rw *.google.cv https://raw.githubusercontent.com *.fermacell.es *.fermacell.de https://james-hardie.bynder.com fermacell.com https://cdn.cookielaw.org *.google.com.tr *.google.mu *.google.cz *.google.mv https://jameshardieeurope--jhfull.sandbox.my.site.com *.google.com.gi https://i.ytimg.com *.google.de *.jameshardie.ch *.google.com.sg *.gstatic.com jameshardie.at *.google.ml *.google.fm *.google.co.il jameshardie.de *.jameshardie.ee *.google.co.mz *.google.co.ke https://yt3.ggpht.com *.google.co.zm *.google.fi
•Unsafe inline execution allowed in default-src
•Unsafe eval() execution allowed in default-src
•Missing recommended values for default-src: self
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✗Referrer-PolicyMissing
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✗X-Content-Type-OptionsMissing
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
How to add it:
nginx
add_header X-Content-Type-Options "nosniff" always;apache
Header always set X-Content-Type-Options "nosniff"cloudflare
Rules > Transform Rules > Managed Transforms > Enable "Add X-Content-Type-Options header"✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✗X-XSS-ProtectionMissing
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
How to add it:
nginx
add_header X-XSS-Protection "0" always;apache
Header always set X-XSS-Protection "0"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-XSS-Protection to "0"4 recommended security headers are missing on jameshardie.ee.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about jameshardie.eeWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
jameshardie.ee
3 scans since 7/18/2025
C
Latest: 60/100
Total Scans
3
Latest Score
60/100
First Scan
7/18/2025
Last Scan
7/18/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/jameshardie.ee" title="Security headers grade for jameshardie.ee — HeaderTest">
<img src="https://headertest.com/api/badge/jameshardie.ee" alt="HeaderTest security grade: C (60/100) for jameshardie.ee" />
</a>Markdown
[](https://headertest.com/results/jameshardie.ee)