Domain History
kone.lt
Grade B · 70/100 · 3/6 security headers present
Security Score
B
70/ 100
Security Headers
3/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'self'; frame-ancestors 'none'; script-src 'self' 'nonce-Rwoq3wCP5RsjJArh57I8RQ==' 'nonce-Vwoq9wCP5RsjJArh57I8RQ==' 'nonce-jpZgc3ugEalR102TlYEBwg==' 'sha256-Wyj4Fv68oVvA79PNKV3Xfi/AffLKqQaGZ+presIFi6c=' 'sha256-hf25XacwFEX2edFU6XuPaCGNkqSHPcH9H5KnyyjBIzg=' 'sha256-6SpaOoYT4+uazco4/BLLRRL9ABMsbI8OCnAPDj6Cg3g=' 'sha256-orTT+ojuF+xljdaz0dT+g06wNnFQt+RUPvCWWLKRzyQ=' 'sha256-bgfJFjw2GH9G4Lz40AnN6msPNNtB48e5PbWLEXKHFB0=' 'sha256-zDMrzfzmZ5+Oq63YfKjl09yuX5pKrT5UZQVhdHHebiM=' 'sha256-XJyWWkzfuHcz8qChX9FwW/LWilUZcPjVkz01lu0+IpM=' 'sha256-SvNfDcY+MfRRT9i7FSQUM5Pv+eG2dCsLCxDxVITD/mU=' 'sha256-linju9CiOFpwsIEAySynCknAN50fPqWjyMGAidJXm0Q=' 'sha256-0PdAbDUELlF605OatfS1JdNafPwwsS+UAYJnmtDxdCY=' 'sha256-RtsER6ZA7tUZAy9k7y98zuZNuPhChsRNKApmKw7c4cs=' 'sha256-9h33cI/L9FsPaSpGST44Xm3ovLBUq+EWi2YZgHIDe4M=' 'sha256-QPLvyMbAL7/DlIuS8I3d29e8s1snv6ou1bt4XoAU3JQ=' 'sha256-lQ2kqE5UfkmueLabejZEMMD8NPLFooL3icWgG2komDs=' 'sha256-HuzPCOKeD/ZkgUp0TBzZ+m8j1lY46pbDLeN6XRS2NrE=' 'sha256-YuyAn+XY5rgWcxm2lvq91LIZps02GC0CjSTRQi4ucbU=' 'sha256-4nIKNbtaDgmq39MAFUWCmqgSkFlVS/LXO/QSsUIAkXU=' 'sha256-Wyj4Fv68oVvA79PNKV3Xfi/AffLKqQaGZ+presIFi6c=' 'sha256-hf25XacwFEX2edFU6XuPaCGNkqSHPcH9H5KnyyjBIzg=' 'sha256-6SpaOoYT4+uazco4/BLLRRL9ABMsbI8OCnAPDj6Cg3g=' 'sha256-orTT+ojuF+xljdaz0dT+g06wNnFQt+RUPvCWWLKRzyQ=' 'sha256-bgfJFjw2GH9G4Lz40AnN6msPNNtB48e5PbWLEXKHFB0=' 'sha256-zDMrzfzmZ5+Oq63YfKjl09yuX5pKrT5UZQVhdHHebiM=' 'sha256-kPqEoL4ljZfF28ScUITz0xQes+Wf6lX/MpGKDJ9mn0g=' 'sha256-CYhl6VU25zW2tuuy5Fdb45gtEVxh/Dx8G8cyB2LhB8g=' 'sha256-XL+xHDk4+oNEXXwzakr0SkCTTl6ht4+uEhSnK6Rd880=' 'sha256-u6zK4WCW0Vob33YKJmFou/J3/SU6iqRSOXczCR+etJw=' 'sha256-x02XACG6aVWmOJsf1wjZPjFrDfQ+1l4T6neCEJvahmM=' 'sha256-U4oYQSReMVV029UME3o0p2vqRcmSgGrOxWSoYRnsGbg=' 'sha256-dCL8zA1cFjajpfdIZLa3osA2dQvgytkztYuM1OwFojQ=' 'sha256-fdsvf3fqrEp+SyQ+1SogXXSLpw9gZfLy6ht9dVPSo2o=' 'sha256-6755NSVRDa1UnzVfdYmrfy4NvYJqBQcxO0hhRsW1VmE=' 'sha256-i59kjMyx/Ix7CahxV3IazCn6o/Xn3k3srG86OR7NP1U=' 'sha256-fyO52xH5CoGmOviwNV2s2MYDerftVL4ftPeFxGBo044=' https://www.google-analytics.com https://kone--full.sandbox.my.site.com https://kone.tfaforms.net https://www.google.com https://www.youtube.com https://content.jwplatform.com https://www.gstatic.com https://ssl.p.jwpcdn.com https://assets.adobedtm.com https://ssl.p.jwpcdn.com https://cdn.jwplayer.com https://cdn-ukwest.onetrust.com https://s.swiftypecdn.com https://tms.kone.com https://storage.googleapis.com https://www.snapengage.com https://www.googletagmanager.com https://www.googleoptimize.com https://plugins.flockler.com https://kone--full.sandbox.my.site.com https://www.googleoptimize.com https://tools.eurolandir.com https://kone.tfaforms.net https://qa-live.kone.com https://static.hotjar.com https://fl-1.cdn.flockler.com https://code.jquery.com https://script.hotjar.com https://connect.facebook.net https://b454ab66b89347d3a00d3736b6dcb498.ent-search.westeurope.azure.elastic-cloud.com https://polyfill.io https://maps.googleapis.com blob:; base-uri 'self'; style-src 'self' 'unsafe-inline' https://kone--full.sandbox.my.site.com https://s.swiftypecdn.com https://fonts.googleapis.com https://stackpath.bootstrapcdn.com https://kone.tfaforms.net https://fl-1.cdn.flockler.com; frame-src 'self' https://www.youtube.com https://events.kone.com https://www.google.com https://kone--full.sandbox.my.site.com https://tools.euroland.com https://konecorp.demdex.net https://player.simplecast.com https://fl-1.cdn.flockler.com https://tools.eurolandir.com; font-src 'self' https://www.kone.com https://storage.googleapis.com https://www.kone.us https://fl-1.cdn.flockler.com https://script.hotjar.com; connect-src 'self' https://www.google.com/ccm/collect/* https://ssl.p.jwpcdn.com https://script.hotjar.com https://vc.hotjar.io https://analytics.formassembly.com https://kone--full.sandbox.my.salesforce-scrt.com https://search-api.swiftype.com https://content.jwplatform.com https://geolocation.onetrust.com https://assets-jpcust.jwpsrv.com https://privacyportal-uk.onetrust.com https://videos-cloudfront-usp.jwpsrv.com https://cdn.jwplayer.com https://cdn-ukwest.onetrust.com https://s.swiftypecdn.com https://dpm.demdex.net https://www.google-analytics.com https://plugins.flockler.com https://www.snapengage.com https://api.swiftype.com https://smetrics.kone.com https://content.hotjar.io wss://ws.hotjar.com https://metrics.hotjar.io https://surveystats.hotjar.io https://b454ab66b89347d3a00d3736b6dcb498.ent-search.westeurope.azure.elastic-cloud.com; media-src 'self' https://kone-aem.adobecqms.net https://www.snapengage.com blob:; img-src 'self' https: http: data: blob:; worker-src 'self' https://qa-live.kone.com blob:;
Directive Analysis
default-srcLOW
'self'
•Missing recommended values for default-src: self
frame-ancestorsLOW
'none'
•Missing recommended values for frame-ancestors: self, none
script-srcMEDIUM
'self' https://cdn-ukwest.onetrust.com https://code.jquery.com blob: 'sha256-RtsER6ZA7tUZAy9k7y98zuZNuPhChsRNKApmKw7c4cs=' 'sha256-i59kjMyx/Ix7CahxV3IazCn6o/Xn3k3srG86OR7NP1U=' https://s.swiftypecdn.com https://ssl.p.jwpcdn.com 'sha256-HuzPCOKeD/ZkgUp0TBzZ+m8j1lY46pbDLeN6XRS2NrE=' 'sha256-x02XACG6aVWmOJsf1wjZPjFrDfQ+1l4T6neCEJvahmM=' https://www.google.com 'sha256-0PdAbDUELlF605OatfS1JdNafPwwsS+UAYJnmtDxdCY=' https://tools.eurolandir.com https://script.hotjar.com https://www.snapengage.com 'sha256-YuyAn+XY5rgWcxm2lvq91LIZps02GC0CjSTRQi4ucbU=' 'sha256-kPqEoL4ljZfF28ScUITz0xQes+Wf6lX/MpGKDJ9mn0g=' 'sha256-dCL8zA1cFjajpfdIZLa3osA2dQvgytkztYuM1OwFojQ=' 'sha256-bgfJFjw2GH9G4Lz40AnN6msPNNtB48e5PbWLEXKHFB0=' https://content.jwplatform.com 'sha256-XL+xHDk4+oNEXXwzakr0SkCTTl6ht4+uEhSnK6Rd880=' 'sha256-Wyj4Fv68oVvA79PNKV3Xfi/AffLKqQaGZ+presIFi6c=' 'sha256-u6zK4WCW0Vob33YKJmFou/J3/SU6iqRSOXczCR+etJw=' 'sha256-6SpaOoYT4+uazco4/BLLRRL9ABMsbI8OCnAPDj6Cg3g=' 'sha256-9h33cI/L9FsPaSpGST44Xm3ovLBUq+EWi2YZgHIDe4M=' 'sha256-XJyWWkzfuHcz8qChX9FwW/LWilUZcPjVkz01lu0+IpM=' https://static.hotjar.com https://www.googletagmanager.com 'nonce-jpZgc3ugEalR102TlYEBwg==' https://kone.tfaforms.net 'sha256-fyO52xH5CoGmOviwNV2s2MYDerftVL4ftPeFxGBo044=' 'sha256-6755NSVRDa1UnzVfdYmrfy4NvYJqBQcxO0hhRsW1VmE=' 'sha256-linju9CiOFpwsIEAySynCknAN50fPqWjyMGAidJXm0Q=' https://cdn.jwplayer.com https://polyfill.io 'sha256-U4oYQSReMVV029UME3o0p2vqRcmSgGrOxWSoYRnsGbg=' 'nonce-Rwoq3wCP5RsjJArh57I8RQ==' 'sha256-zDMrzfzmZ5+Oq63YfKjl09yuX5pKrT5UZQVhdHHebiM=' https://www.youtube.com 'sha256-hf25XacwFEX2edFU6XuPaCGNkqSHPcH9H5KnyyjBIzg=' https://assets.adobedtm.com 'sha256-orTT+ojuF+xljdaz0dT+g06wNnFQt+RUPvCWWLKRzyQ=' https://qa-live.kone.com https://maps.googleapis.com https://www.google-analytics.com 'nonce-Vwoq9wCP5RsjJArh57I8RQ==' 'sha256-QPLvyMbAL7/DlIuS8I3d29e8s1snv6ou1bt4XoAU3JQ=' https://connect.facebook.net https://b454ab66b89347d3a00d3736b6dcb498.ent-search.westeurope.azure.elastic-cloud.com 'sha256-fdsvf3fqrEp+SyQ+1SogXXSLpw9gZfLy6ht9dVPSo2o=' https://fl-1.cdn.flockler.com https://www.googleoptimize.com 'sha256-lQ2kqE5UfkmueLabejZEMMD8NPLFooL3icWgG2komDs=' https://plugins.flockler.com https://storage.googleapis.com 'sha256-SvNfDcY+MfRRT9i7FSQUM5Pv+eG2dCsLCxDxVITD/mU=' 'sha256-CYhl6VU25zW2tuuy5Fdb45gtEVxh/Dx8G8cyB2LhB8g=' https://tms.kone.com https://www.gstatic.com 'sha256-4nIKNbtaDgmq39MAFUWCmqgSkFlVS/LXO/QSsUIAkXU=' https://kone--full.sandbox.my.site.com
•Missing recommended values for script-src: sha256-, nonce-, self, sha384-, sha512-
•No nonces or hashes used for script-src
base-uriLOW
'self'
•Missing recommended values for base-uri: self, none
style-srcHIGH
'self' https://fonts.googleapis.com https://kone.tfaforms.net https://s.swiftypecdn.com https://stackpath.bootstrapcdn.com https://fl-1.cdn.flockler.com 'unsafe-inline' https://kone--full.sandbox.my.site.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, nonce-, self, sha384-, sha512-
frame-srcLOW
'self' https://tools.euroland.com https://player.simplecast.com https://events.kone.com https://fl-1.cdn.flockler.com https://tools.eurolandir.com https://www.google.com https://www.youtube.com https://konecorp.demdex.net https://kone--full.sandbox.my.site.com
•Missing recommended values for frame-src: self
font-srcLOW
'self' https://fl-1.cdn.flockler.com https://www.kone.us https://script.hotjar.com https://storage.googleapis.com https://www.kone.com
•Missing recommended values for font-src: self
connect-srcLOW
'self' https://cdn-ukwest.onetrust.com https://s.swiftypecdn.com https://ssl.p.jwpcdn.com https://videos-cloudfront-usp.jwpsrv.com https://script.hotjar.com https://www.snapengage.com https://content.hotjar.io https://search-api.swiftype.com https://analytics.formassembly.com https://metrics.hotjar.io https://assets-jpcust.jwpsrv.com https://api.swiftype.com https://content.jwplatform.com https://privacyportal-uk.onetrust.com https://smetrics.kone.com https://surveystats.hotjar.io wss://ws.hotjar.com https://geolocation.onetrust.com https://www.google.com/ccm/collect/* https://dpm.demdex.net https://cdn.jwplayer.com https://vc.hotjar.io https://www.google-analytics.com https://b454ab66b89347d3a00d3736b6dcb498.ent-search.westeurope.azure.elastic-cloud.com https://plugins.flockler.com https://kone--full.sandbox.my.salesforce-scrt.com
•Missing recommended values for connect-src: self
media-srcLOW
'self' blob: https://www.snapengage.com https://kone-aem.adobecqms.net
•Missing recommended values for media-src: self
img-srcMEDIUM
'self' http: blob: data: https:
•Insecure HTTP source allowed in img-src
•Missing recommended values for img-src: self
worker-srcLOW
'self' blob: https://qa-live.kone.com
•Missing recommended values for worker-src: self, none
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✗Referrer-PolicyMissing
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✗X-Content-Type-OptionsMissing
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
How to add it:
nginx
add_header X-Content-Type-Options "nosniff" always;apache
Header always set X-Content-Type-Options "nosniff"cloudflare
Rules > Transform Rules > Managed Transforms > Enable "Add X-Content-Type-Options header"✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
3 recommended security headers are missing on kone.lt.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about kone.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
kone.lt
2 scans since 7/16/2025
B
Latest: 70/100
Total Scans
2
Latest Score
70/100
First Scan
7/16/2025
Last Scan
7/16/2025
Scan History
| Date | Score | CSP | Headers | Issues | Action |
|---|---|---|---|---|---|
| Jul 16, 2025 | B (70) | No | 3/6 | 0 | View → |
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/kone.lt" title="Security headers grade for kone.lt — HeaderTest">
<img src="https://headertest.com/api/badge/kone.lt" alt="HeaderTest security grade: B (70/100) for kone.lt" />
</a>Markdown
[](https://headertest.com/results/kone.lt)