Domain History

kebabstop.ee

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+

90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

upgrade-insecure-requests;frame-ancestors 'self';object-src 'none';base-uri 'self';script-src 'report-sample' https: 'unsafe-inline' 'wasm-unsafe-eval' 'strict-dynamic' 'sha256-wDkOnY488UsdiT+Fni3PAYzYjaXqcMGJsemH5GvnTDE=' 'sha256-EhG/h/RqHxTHE7up89blJbhWNGWdDgROL67iVto2piQ=' 'sha256-Y4MbHjcH1NSWc7vI/EKYhmmTS1GWpym1LMK3AsbLURg=' 'sha256-YIufDoj6y0Y18IcsPSb07+YeySn49M6NodyPWAxnlEQ=' 'sha256-ISQlx8Dt5uJdxK8fu9yaJi2YDXDIrSNzxnMY6D8fN4k=' 'sha256-bhewSSs4yRTWvvCEB7hDWGanjZSWX+QYibQ47k6nIFM=' 'sha256-GWPs3ff/eEUpIHBCfiG2hQFUhm2bytyGTvw5JYEDpYE=' 'sha256-z73mDVDe+B5YOJzF2ZtCpc29uzOdRps6f2q6txl5nKY=' 'sha256-dIuPvH5G22rR46K/dLacRkt7VclCd6PIpCJCqeXzG/U=' 'sha256-FGK/RxZzdOWkpJPWAnkg0/SAqXhy9pWQquKSL5rtfQA=' 'sha256-HxJMxKvhswMi1r/QSdgbcaZzlFwagdzaZL9z8rqyIrA=' 'sha256-NN97qvDjLZPgp2h56/ka/LsTuMsApbVx3AcgJ6Tj9vQ=' 'sha256-nQUQv4NRAFbeLP/08iyBazy1nuhn9Hpu767djoH5wP0=' 'sha256-QF96T7/lQpp2mUE/Ht+fHNz7+ZoIlani6ZIdb6NkKJg=' 'sha256-MP5eVdsFLsRCg87v795UdByGYcUjxhizZ11v01i97V4=' 'sha256-gwuY6kVYQa++oy7tjXnqyDhWqt62W3zDQAehYESJ6CQ=' 'sha256-nOVDZrw8e4IvDMBGldjeI/99+c9ylDGRnuAcIlhj/bw=' 'sha256-e6fSRsU4kodhEc7A+I+wRoo6ATt973E29SFzp/EVtiw=' 'sha256-UtXVVmYMA47gRZe1QZggSbTFMNNBlzzGHdS4e5UhiSw=' 'sha256-tui0MRO83CjeODc2k2jvracfDIj24vJ4Fa7xCJGhNQo=' 'sha256-u77I658BmHPvzPY3ZOhuH1mCKyRssMDjhNi8i16mSsQ=' 'sha256-SzVxKjQzg/khxaMq/PaiNgRLd/FD1yDpRUxmQAjed4U=' 'sha256-z9vVhZXQ75RlSWmbfVrrIrZWOdgPbcyYf88Tje/GMAg=' 'sha256-u4S3pSiSKJV/sykNkOTqvoMRJohSJqZ413Wzovbhwlg=' 'sha256-DGUdujw1abUBT189/oLTAntwPrQSeQQkEUo3x3UA+C4=' 'sha256-sqI+mBEjFc/KVO7NcEz8SQjj6sO5VFhSovU/MFQWwHo=' 'sha256-yQOpCdmgyqb6Lu62sGo7i84eMrFuHIeolGCnsYrUzdE=' 'sha256-HSTstamrPaa6EFrAuMCMJOcSdhTsOSrD63ib570tyIk=' 'sha256-/0Iif0Z1w2xl85zv8ruyaEsGv2N4jhN3uxnModPMQog=' 'sha256-3BDNFQczXK3ZbBLp1MO6Bpyr9e/NuPn7NXBf9CJ3+C8=' 'sha256-Ov2nOxPqhyok9PXIZh4hM3Gp7y7wVOHYowfc9CItaCo=' 'sha256-MYOKrsJPxB1GMGELLqGPV2RTFEXVpERakLzx68rjdOc=' 'sha256-4UkUafqtEvAjCAZ5zZaeczmfxORfc/qLJhEiO0OfHRY=' 'sha256-seyB72MNWsf96H11lSGa+G0VBXtO3807835SDzwlm8U=' 'sha256-IrS2g6N39wywDA/LQ+afycu49yAbc+EqcNU3e3WmG1U=' 'sha256-GfZ0KSFEvmz6/j/ZXP2fDDncfe4zcMrcL3SwveoG3E4=' 'sha256-1asa9aDHvvJFPnFrg0jGMN+hjL3YXrD4ULP+QIHGZEg=' 'sha256-6dFfVS+vDvd/rqBw0djfKXSFaiWh5arB6kSzdA4Uv1Y=' 'sha256-3YyZvRvLE4P/i9PzxyyUXmi0u5NyMON0yiXTUDBv+YM=' 'sha256-35lLnair6sE/3nT712C2Wum8ArG1T8FomIjwatu0P5k=' 'sha256-IXOcLtAKRja/AptF8qzDcc5nISHnimtZvgtyv+V6i64=' 'sha256-Sf1rpOxw4zaqzBx8m/BBZcDvxzoLdBXuzKrNW7SSWk0=';worker-src blob:;report-uri https://browser-intake-datadoghq.eu/api/v2/logs?dd-api-key=pubc504e1394818288959b4d64fb38efebe&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=service%3Awolt.com%2Cversion%3A1.15.50-PR17907

Directive Analysis

upgrade-insecure-requestsLOW

frame-ancestorsLOW

'self'

•Missing recommended values for frame-ancestors: none, self

object-srcLOW

'none'

•Missing recommended values for object-src: none

base-uriLOW

'self'

•Missing recommended values for base-uri: none, self

script-srcHIGH

'sha256-gwuY6kVYQa++oy7tjXnqyDhWqt62W3zDQAehYESJ6CQ=' 'sha256-u77I658BmHPvzPY3ZOhuH1mCKyRssMDjhNi8i16mSsQ=' 'sha256-z73mDVDe+B5YOJzF2ZtCpc29uzOdRps6f2q6txl5nKY=' 'sha256-yQOpCdmgyqb6Lu62sGo7i84eMrFuHIeolGCnsYrUzdE=' 'sha256-IrS2g6N39wywDA/LQ+afycu49yAbc+EqcNU3e3WmG1U=' 'sha256-e6fSRsU4kodhEc7A+I+wRoo6ATt973E29SFzp/EVtiw=' 'wasm-unsafe-eval' 'sha256-GfZ0KSFEvmz6/j/ZXP2fDDncfe4zcMrcL3SwveoG3E4=' 'sha256-6dFfVS+vDvd/rqBw0djfKXSFaiWh5arB6kSzdA4Uv1Y=' 'sha256-MYOKrsJPxB1GMGELLqGPV2RTFEXVpERakLzx68rjdOc=' 'sha256-HSTstamrPaa6EFrAuMCMJOcSdhTsOSrD63ib570tyIk=' 'sha256-Y4MbHjcH1NSWc7vI/EKYhmmTS1GWpym1LMK3AsbLURg=' 'sha256-4UkUafqtEvAjCAZ5zZaeczmfxORfc/qLJhEiO0OfHRY=' 'sha256-nQUQv4NRAFbeLP/08iyBazy1nuhn9Hpu767djoH5wP0=' 'sha256-wDkOnY488UsdiT+Fni3PAYzYjaXqcMGJsemH5GvnTDE=' 'sha256-seyB72MNWsf96H11lSGa+G0VBXtO3807835SDzwlm8U=' https: 'sha256-nOVDZrw8e4IvDMBGldjeI/99+c9ylDGRnuAcIlhj/bw=' 'sha256-DGUdujw1abUBT189/oLTAntwPrQSeQQkEUo3x3UA+C4=' 'unsafe-inline' 'sha256-EhG/h/RqHxTHE7up89blJbhWNGWdDgROL67iVto2piQ=' 'sha256-GWPs3ff/eEUpIHBCfiG2hQFUhm2bytyGTvw5JYEDpYE=' 'sha256-sqI+mBEjFc/KVO7NcEz8SQjj6sO5VFhSovU/MFQWwHo=' 'sha256-IXOcLtAKRja/AptF8qzDcc5nISHnimtZvgtyv+V6i64=' 'strict-dynamic' 'sha256-35lLnair6sE/3nT712C2Wum8ArG1T8FomIjwatu0P5k=' 'sha256-Ov2nOxPqhyok9PXIZh4hM3Gp7y7wVOHYowfc9CItaCo=' 'report-sample' 'sha256-SzVxKjQzg/khxaMq/PaiNgRLd/FD1yDpRUxmQAjed4U=' 'sha256-HxJMxKvhswMi1r/QSdgbcaZzlFwagdzaZL9z8rqyIrA=' 'sha256-MP5eVdsFLsRCg87v795UdByGYcUjxhizZ11v01i97V4=' 'sha256-dIuPvH5G22rR46K/dLacRkt7VclCd6PIpCJCqeXzG/U=' 'sha256-FGK/RxZzdOWkpJPWAnkg0/SAqXhy9pWQquKSL5rtfQA=' 'sha256-/0Iif0Z1w2xl85zv8ruyaEsGv2N4jhN3uxnModPMQog=' 'sha256-ISQlx8Dt5uJdxK8fu9yaJi2YDXDIrSNzxnMY6D8fN4k=' 'sha256-YIufDoj6y0Y18IcsPSb07+YeySn49M6NodyPWAxnlEQ=' 'sha256-z9vVhZXQ75RlSWmbfVrrIrZWOdgPbcyYf88Tje/GMAg=' 'sha256-bhewSSs4yRTWvvCEB7hDWGanjZSWX+QYibQ47k6nIFM=' 'sha256-u4S3pSiSKJV/sykNkOTqvoMRJohSJqZ413Wzovbhwlg=' 'sha256-QF96T7/lQpp2mUE/Ht+fHNz7+ZoIlani6ZIdb6NkKJg=' 'sha256-3BDNFQczXK3ZbBLp1MO6Bpyr9e/NuPn7NXBf9CJ3+C8=' 'sha256-Sf1rpOxw4zaqzBx8m/BBZcDvxzoLdBXuzKrNW7SSWk0=' 'sha256-tui0MRO83CjeODc2k2jvracfDIj24vJ4Fa7xCJGhNQo=' 'sha256-NN97qvDjLZPgp2h56/ka/LsTuMsApbVx3AcgJ6Tj9vQ=' 'sha256-3YyZvRvLE4P/i9PzxyyUXmi0u5NyMON0yiXTUDBv+YM=' 'sha256-1asa9aDHvvJFPnFrg0jGMN+hjL3YXrD4ULP+QIHGZEg=' 'sha256-UtXVVmYMA47gRZe1QZggSbTFMNNBlzzGHdS4e5UhiSw='

•Unsafe inline execution allowed in script-src

•Missing recommended values for script-src: sha512-, sha256-, sha384-, nonce-, self

•No nonces or hashes used for script-src

worker-srcLOW

blob:

•Missing recommended values for worker-src: none, self

report-uriLOW

https://browser-intake-datadoghq.eu/api/v2/logs?dd-api-key=pubc504e1394818288959b4d64fb38efebe&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=service%3Awolt.com%2Cversion%3A1.15.50-PR17907

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=15768000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on kebabstop.ee.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about kebabstop.eeWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

kebabstop.ee

3 scans since 7/18/2025

A+

Latest: 90/100

Total Scans

Latest Score

90/100

First Scan

7/18/2025

Last Scan

7/18/2025

Score Trend

Security score progression over 2 scans

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 18, 2025	A+ (90)	No	5/6	0	View →
Jul 18, 2025	A+ (90)	No	5/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for kebabstop.ee

HTML

<a href="https://headertest.com/results/kebabstop.ee" title="Security headers grade for kebabstop.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/kebabstop.ee" alt="HeaderTest security grade: A+ (90/100) for kebabstop.ee" />
</a>

Markdown

[![HeaderTest security grade: A+ (90/100) for kebabstop.ee](https://headertest.com/api/badge/kebabstop.ee)](https://headertest.com/results/kebabstop.ee)