Domain History

kidzone.lt

Grade A · 80/100 · 5/6 security headers present

Security Score

80/ 100

Security Headers

5/ 6

CSP Violations

2Violations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src * 'unsafe-inline' 'unsafe-eval' data: blob: *.videoly.co *.youtube-nocookie.com *.youtube.com *.ytimg.com *.wistia.com *.wistia.net *.videoly.net *.twistoo.co; connect-src 'self' *.googletagmanager.com *.igodigital.com *.maxcdn.com *.polyfill.io *.facebook.net *.facebook.com *.searchnode.io *.omnisrc.com *.bitrec.io *.google.com *.google.ee *.google.fi *.google.lv *.google.lt *.google-analytics.com *.doubleclick.net *.soundestlink.com *.nr-data.net *.esto.ee *.hotjar.io *.cookieinformation.com *.searchnode.net *.bing.com *.googleapis.com *.googleadservices.com *.issuu.com *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.twistoo.co t.cometlytrack.com google.com *.nosto.com respondent.survicate.com survey.survicate.com survey-prd.survicate-cdn.com *.cookieyes.com cdn-cookieyes.com; font-src 'self' *.gstatic.com data: *.123formbuilder.com *.issuu.com *.bootstrapcdn.com *.twistoo.co surveys-static.survicate.com surveys-static-prd.survicate-cdn.com cdn.jsdelivr.net; frame-src 'self' *.123formbuilder.com *.facebook.com *.cookieinformation.com *.youtube.com *.youtube-nocookie.com *.issuu.com *.videoly.net *.cookiebot.com *.doubleclick.net *.flippingbook.com publuu.com googletagmanager.com *.google.com; img-src 'self' data: kotrynagroup.lt *.kotrynagroup.lt *.babycity.lt *.babycity.lv *.babycity.ee *.kidzone.lt *.kidzone.lv *.kidzone.ee *.kidzone.fi *.toycity.lt *.toycity.lv *.zaisluplaneta.lt *.jukukeskus.ee *.toysplanet.lv *.igodigital.com *.bing.com *.facebook.com *.google-analytics.com *.google.com *.google.lt *.google.lv *.google.ee *.google.fi *.ytimg.com *.videoly.co *.adnxs.com *.reddit.com *.googleapis.com *.gstatic.com *.youtube.com *.ckeditor.com *.doubleclick.net *.kotrynagroup.com *.googleadservices.com *.googletagmanager.com *.issuu.com *.wistia.com *.wistia.net *.cookiebot.com analytics.tiktok.com *.twistoo.co surveys-static.survicate.com surveys-static-prd.survicate-cdn.com assets.survicate.com img.survicate.com images.unsplash.com cdn-cookieyes.com; media-src *.twistoo.co data:; script-src 'self' 'unsafe-hashes' 'unsafe-eval' 'unsafe-inline' *.nr-data.net *.google.com *.google.lt *.google.lv *.google.fi *.google.ee *.igodigital.com polyfill.io *.bitrec.com *.googletagmanager.com *.facebook.net *.searchnode.io *.google-analytics.com *.doubleclick.net *.hotjar.com *.bing.com *.youtube.com omnisrc.com *.sentry-cdn.com *.soundestlink.com omnisnippet1.com *.doubleclick.net *.newrelic.com *.videoly.co *.123formbuilder.com *.esto.ee *.redditstatic.com *.cookieinformation.com *.adnxs.com *.googleapis.com *.ckeditor.com *.jsdelivr.net *.googleadservices.com *.issuu.com *.youtube-nocookie.com *.ytimg.com *.videoly.net *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.publuu.com cdnjs.cloudflare.com *.twistoo.co t.cometlytrack.com static.cloudflareinsights.com *.nosto.com nosto.stackla.com *.cloudfront.net survey.survicate.com surveys-static.survicate.com surveys-static-prd.survicate-cdn.com survey-prd.survicate-cdn.com cdn-cookieyes.com; style-src 'self' 'unsafe-inline' *.googleapis.com *.123formbuilder.com *.ckeditor.com *.jsdelivr.net *.issuu.com *.bootstrapcdn.com cdnjs.cloudflare.com *.twistoo.co *.cloudfront.net surveys-static.survicate.com surveys-static-prd.survicate-cdn.com

Directive Analysis

default-srcHIGH

*.wistia.net *.twistoo.co *.ytimg.com *.youtube.com data: 'unsafe-inline' blob: 'unsafe-eval' *.youtube-nocookie.com *.wistia.com * *.videoly.co *.videoly.net

•Unsafe inline execution allowed in default-src

•Unsafe eval() execution allowed in default-src

•Overly permissive wildcard (*) in default-src

•Missing recommended values for default-src: self

•Overly permissive default-src directive

connect-srcLOW

*.hotjar.io *.omnisrc.com *.igodigital.com *.facebook.net *.google.com survey-prd.survicate-cdn.com *.searchnode.io *.googleapis.com *.googletagmanager.com *.facebook.com *.esto.ee capig.stape.host *.google.fi analytics.tiktok.com *.cookieinformation.com *.google.lv *.twistoo.co *.google.ee respondent.survicate.com *.soundestlink.com *.google.lt *.searchnode.net *.bitrec.io *.doubleclick.net *.cookiebot.com *.nr-data.net stape.io *.bing.com google.com *.issuu.com *.nosto.com *.googleadservices.com *.cookieyes.com t.cometlytrack.com *.polyfill.io *.google-analytics.com survey.survicate.com 'self' cdn-cookieyes.com *.maxcdn.com

•Missing recommended values for connect-src: self

font-srcLOW

surveys-static.survicate.com *.bootstrapcdn.com *.twistoo.co cdn.jsdelivr.net *.gstatic.com data: *.issuu.com 'self' *.123formbuilder.com surveys-static-prd.survicate-cdn.com

•Missing recommended values for font-src: self

frame-srcLOW

*.cookieinformation.com publuu.com googletagmanager.com *.google.com *.youtube.com *.cookiebot.com *.doubleclick.net *.flippingbook.com *.youtube-nocookie.com 'self' *.issuu.com *.facebook.com *.123formbuilder.com *.videoly.net

•Missing recommended values for frame-src: self

img-srcLOW

*.wistia.net img.survicate.com *.igodigital.com *.google.com *.gstatic.com *.toysplanet.lv *.googleapis.com *.facebook.com *.googletagmanager.com *.google.fi analytics.tiktok.com *.reddit.com *.babycity.lv *.kidzone.lt surveys-static.survicate.com *.google.lv *.twistoo.co images.unsplash.com *.kidzone.fi assets.survicate.com data: *.google.ee *.babycity.ee *.videoly.co *.ckeditor.com *.google.lt *.babycity.lt kotrynagroup.lt *.kotrynagroup.lt *.kidzone.ee *.youtube.com *.doubleclick.net *.cookiebot.com *.bing.com *.adnxs.com *.wistia.com *.issuu.com *.googleadservices.com surveys-static-prd.survicate-cdn.com *.jukukeskus.ee *.kotrynagroup.com *.kidzone.lv *.zaisluplaneta.lt *.toycity.lv *.ytimg.com *.google-analytics.com 'self' *.toycity.lt cdn-cookieyes.com

•Missing recommended values for img-src: self

media-srcLOW

data: *.twistoo.co

•Missing recommended values for media-src: self

script-srcHIGH

*.igodigital.com *.google.com polyfill.io *.facebook.net survey-prd.survicate-cdn.com *.searchnode.io *.googleapis.com *.googletagmanager.com *.hotjar.com *.esto.ee capig.stape.host *.google.fi analytics.tiktok.com *.redditstatic.com *.publuu.com *.cookieinformation.com *.bitrec.com surveys-static.survicate.com *.newrelic.com *.google.lv *.twistoo.co 'unsafe-inline' *.google.ee *.youtube-nocookie.com cdnjs.cloudflare.com *.cloudfront.net omnisnippet1.com *.123formbuilder.com *.soundestlink.com *.videoly.co *.ckeditor.com 'unsafe-hashes' *.google.lt *.videoly.net *.sentry-cdn.com *.doubleclick.net *.youtube.com *.nr-data.net *.cookiebot.com *.bing.com 'unsafe-eval' *.adnxs.com *.issuu.com stape.io static.cloudflareinsights.com *.nosto.com *.googleadservices.com surveys-static-prd.survicate-cdn.com omnisrc.com *.jsdelivr.net t.cometlytrack.com *.ytimg.com nosto.stackla.com survey.survicate.com *.google-analytics.com 'self' cdn-cookieyes.com

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•Missing recommended values for script-src: sha384-, sha256-, nonce-, sha512-, self

•No nonces or hashes used for script-src

style-srcHIGH

*.jsdelivr.net surveys-static.survicate.com *.bootstrapcdn.com *.twistoo.co 'unsafe-inline' *.googleapis.com 'self' *.issuu.com cdnjs.cloudflare.com *.cloudfront.net *.123formbuilder.com surveys-static-prd.survicate-cdn.com *.ckeditor.com

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: sha384-, sha256-, nonce-, sha512-, self

Violations

•https://www.googletagmanager.com/gtag/js?id=AW-831162388&cx=c&gtm=45He57e1v846697946za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104879961~104908318~104908320 119 Refused to connect to 'https://pagead2.googlesyndication.com/ccm/collect?tid=AW-831162388&en=page_view&dl=https%3A%2F%2Fwww.kidzone.lt%2Flt%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1924674751.1752648620&navt=n&npa=1&did=dY2Q2ZW&gdid=dY2Q2ZW&_tu=CA&gtm=45be57e1v9181636246z8846697946za200zb846697946&gcs=G100&gcd=13p3p3p3p5l1&dma_cps=-&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908318~104908320&tft=1752648619802&tfd=5603&apve=1&apvf=sb' because it violates the following Content Security Policy directive: "connect-src 'self' *.googletagmanager.com *.igodigital.com *.maxcdn.com *.polyfill.io *.facebook.net *.facebook.com *.searchnode.io *.omnisrc.com *.bitrec.io *.google.com *.google.ee *.google.fi *.google.lv *.google.lt *.google-analytics.com *.doubleclick.net *.soundestlink.com *.nr-data.net *.esto.ee *.hotjar.io *.cookieinformation.com *.searchnode.net *.bing.com *.googleapis.com *.googleadservices.com *.issuu.com *.cookiebot.com stape.io capig.stape.host analytics.tiktok.com *.twistoo.co t.cometlytrack.com google.com *.nosto.com respondent.survicate.com survey.survicate.com survey-prd.survicate-cdn.com *.cookieyes.com cdn-cookieyes.com".

•https://www.googletagmanager.com/ - Refused to frame 'https://www.googletagmanager.com/' because it violates the following Content Security Policy directive: "frame-src 'self' *.123formbuilder.com *.facebook.com *.cookieinformation.com *.youtube.com *.youtube-nocookie.com *.issuu.com *.videoly.net *.cookiebot.com *.doubleclick.net *.flippingbook.com publuu.com googletagmanager.com *.google.com".

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=15724800; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

sameorigin

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on kidzone.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about kidzone.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

kidzone.lt

2 scans since 7/16/2025

Latest: 80/100

Total Scans

Latest Score

80/100

First Scan

7/16/2025

Last Scan

7/16/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 16, 2025	A (80)	No	5/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A (80/100) for kidzone.lt

HTML

<a href="https://headertest.com/results/kidzone.lt" title="Security headers grade for kidzone.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/kidzone.lt" alt="HeaderTest security grade: A (80/100) for kidzone.lt" />
</a>

Markdown

[![HeaderTest security grade: A (80/100) for kidzone.lt](https://headertest.com/api/badge/kidzone.lt)](https://headertest.com/results/kidzone.lt)