Domain History
joom.lv
Grade A · 80/100 · 4/6 security headers present
Security Score
A
80/ 100
Security Headers
4/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src blob: ;child-src blob: 'self' https://d13h4w8gjgv887.cloudfront.net;media-src blob: 'self' https://video.joomcdn.net https://*.amazonaws.com https://d13h4w8gjgv887.cloudfront.net;form-action https:;frame-src 'self' https: ;frame-ancestors 'none';manifest-src 'self';base-uri 'none';font-src 'self' data: https://*.joomcdn.net https://*.jmtcdn.ru https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://d13h4w8gjgv887.cloudfront.net https://hcaptcha.com https://*.hcaptcha.com https://cdn.crowdin.com https://top-fwz1.mail.ru;connect-src 'self' https://api.joom.com https://api-secure.joom.one https://api.joompay.tech https://http-babylone-client-faq-api.joom.it https://*.google-analytics.com https://*.analytics.google.com https://*.googleapis.com https://google-analytics.com https://analytics.google.com https://pagead2.googlesyndication.com https://www.facebook.com https://bnc.lt https://joom.test-app.link https://stats.g.doubleclick.net https://*.joomcdn.net https://*.jmtcdn.ru https://*.amazonaws.com https://mc.yandex.ru https://mc.yandex.com https://api-maps.yandex.ru https://yastatic.net https://*.maps.yandex.net https://d13h4w8gjgv887.cloudfront.net https://hcaptcha.com https://*.hcaptcha.com https://*.live-video.net https://joom-web.ey.r.appspot.com https://crowdin.com https://widget.trustpilot.com https://*.creativecdn.com https://*.dwin1.com https://top-fwz1.mail.ru https://www.wepowerconnections.com https://tr.kickbite.io https://service.nalog.ru https://*.clarity.ms https://analytics.tiktok.com https://s.kelkoogroup.net https://*.mts.ru https://www.google.com https://google.com https://pay.google.com https://*.criteo.com https://sentry.joom.it;img-src 'self' data: https: blob:;script-src 'strict-dynamic' 'nonce-MC43NDA3MDU=' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' https: data: 'unsafe-inline' https://*.joomcdn.net https://*.jmtcdn.ru https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://d13h4w8gjgv887.cloudfront.net https://hcaptcha.com https://*.hcaptcha.com https://cdn.crowdin.com https://top-fwz1.mail.ru
Directive Analysis
default-srcLOW
blob:
•Missing recommended values for default-src: self
child-srcLOW
blob: https://d13h4w8gjgv887.cloudfront.net 'self'
•Unknown directive: child-src
media-srcLOW
blob: https://*.amazonaws.com 'self' https://d13h4w8gjgv887.cloudfront.net https://video.joomcdn.net
•Missing recommended values for media-src: self
form-actionLOW
https:
•Missing recommended values for form-action: self
frame-srcLOW
'self' https:
•Missing recommended values for frame-src: self
frame-ancestorsLOW
'none'
•Missing recommended values for frame-ancestors: none, self
manifest-srcLOW
'self'
•Missing recommended values for manifest-src: self
base-uriLOW
'none'
•Missing recommended values for base-uri: none, self
font-srcLOW
https://cdn.crowdin.com https://fonts.googleapis.com https://*.joomcdn.net https://top-fwz1.mail.ru https://fonts.gstatic.com 'self' https://d13h4w8gjgv887.cloudfront.net https://hcaptcha.com https://*.jmtcdn.ru https://tagmanager.google.com data: https://*.hcaptcha.com
•Missing recommended values for font-src: self
connect-srcLOW
https://www.wepowerconnections.com https://*.googleapis.com https://*.analytics.google.com https://*.amazonaws.com https://*.live-video.net https://api-secure.joom.one https://api.joom.com https://*.maps.yandex.net https://*.clarity.ms https://tr.kickbite.io https://service.nalog.ru https://*.joomcdn.net https://mc.yandex.ru https://google-analytics.com https://api-maps.yandex.ru https://stats.g.doubleclick.net https://widget.trustpilot.com https://analytics.tiktok.com https://joom.test-app.link https://s.kelkoogroup.net https://analytics.google.com https://*.hcaptcha.com https://*.dwin1.com https://top-fwz1.mail.ru https://sentry.joom.it https://api.joompay.tech 'self' https://*.creativecdn.com https://d13h4w8gjgv887.cloudfront.net https://joom-web.ey.r.appspot.com https://www.facebook.com https://bnc.lt https://google.com https://mc.yandex.com https://*.google-analytics.com https://pagead2.googlesyndication.com https://*.mts.ru https://crowdin.com https://pay.google.com https://*.criteo.com https://hcaptcha.com https://*.jmtcdn.ru https://www.google.com https://yastatic.net https://http-babylone-client-faq-api.joom.it
•Missing recommended values for connect-src: self
img-srcLOW
data: 'self' blob: https:
•Missing recommended values for img-src: self
script-srcHIGH
https: 'strict-dynamic' 'unsafe-inline' 'nonce-MC43NDA3MDU=' 'unsafe-eval'
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha256-, nonce-, sha512-, self, sha384-
•No nonces or hashes used for script-src
style-srcHIGH
https://cdn.crowdin.com https://fonts.googleapis.com https://*.joomcdn.net https://top-fwz1.mail.ru https://fonts.gstatic.com 'self' https: https://d13h4w8gjgv887.cloudfront.net https://hcaptcha.com https://tagmanager.google.com 'unsafe-inline' https://*.jmtcdn.ru data: https://*.hcaptcha.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, nonce-, sha512-, self, sha384-
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✗Referrer-PolicyMissing
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"✓Strict-Transport-SecurityPresent
max-age=63072000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
deny
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
2 recommended security headers are missing on joom.lv.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about joom.lvWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
joom.lv
3 scans since 7/17/2025
A
Latest: 80/100
Total Scans
3
Latest Score
80/100
First Scan
7/17/2025
Last Scan
7/17/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/joom.lv" title="Security headers grade for joom.lv — HeaderTest">
<img src="https://headertest.com/api/badge/joom.lv" alt="HeaderTest security grade: A (80/100) for joom.lv" />
</a>Markdown
[](https://headertest.com/results/joom.lv)