Domain History
lidl.lt
Grade F · 32/100 · 4/7 security headers present
Security Score
F
32/ 100
Security Headers
4/ 7
CSP Violations
NoViolations
Issues Found
19Issues
Recommendations
3Available
Security
32 / 100Significant security weaknesses detected in CSP configuration.
Compliance
66 / 100Several compliance gaps found in CSP implementation.
Best Practices
47 / 100Few best practices adopted — significant room for improvement.
CSP Analysis
Content Security PolicyHIGH
base-uri 'self'; default-src 'self' 'unsafe-inline' blob: data: https://*.adsrvr.org https://*.adyen.com https://*.api.schwarz https://*.app.baqend.com https://*.assets.schwarz https://*.batch.com https://*.bing.com https://*.clarity.ms https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.exactag.com https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.frcapi.com https://*.friendlycaptcha.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.lidl.lt https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.onetrust.com https://*.peakprotect.com https://*.pingdom.net https://*.scon.schwarz https://*.simplesurance.com https://*.virtualearth.net https://*.youtube-nocookie.com https://*.youtube.com https://analytics.google.com https://asset.schwarz https://autosuggest.search.hereapi.com https://bat.bing.net https://bidswitch.net https://cdn.cookielaw.org https://creativecdn.com https://csp-service.prod-varnish-ha-myra.lidl-shop.com https://form.lidl.com https://google.com https://lidl.de https://lidl.media.schwarz https://lidl.media01.eu https://lidlplusprod.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://mycliplister.com https://region1.analytics.google.com https://s.kelkoogroup.net https://s.kk-resources.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://upeimagesprd.blob.core.windows.net https://www.awin1.com https://www.google.be https://www.google.com https://www.google.cz https://www.google.nl https://www.google.pl https://www.google.sk https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com wss://endpoint-prod.scon.schwarz; form-action 'self' https://*.facebook.com https://*.facebook.net https://accounts.lidl.com https://payments.lidlplus.com https://survey.g.doubleclick.net; frame-ancestors 'self' https://*.lidl.com https://*.livebuy.io; frame-src 'self' 'unsafe-inline' https://*.adsrvr.org https://*.adyen.com https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.frcapi.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.lidl.lt https://*.livebuy.io https://*.medallia.eu https://*.pingdom.net https://*.youtube-nocookie.com https://*.youtube.com https://balancechecks.tx-gate.com https://bidswitch.net https://creativecdn.com https://form.lidl.com https://forms-prod.enc-test.de/ https://ldl.viewer.cit-fusion.com https://lidl.de https://lidl.media01.eu https://link.tink.com https://manuals.sit-connect.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-gewinnspiel.de https://www.youtube.com https://youtube.com; img-src 'self' 'unsafe-inline' blob: data: https://*.360yield.com https://*.addthis.com https://*.adnxs.com https://*.adyen.com https://*.app.baqend.com https://*.assets.schwarz https://*.bing.com https://*.casalemedia.com https://*.cat-ret.assets.lidl https://*.cdn.flavedo.io https://*.clarity.ms https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.de https://*.lidl.lt https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.retail.lidl.net https://*.retail.vdc.lidl https://*.searchhub.io https://*.smartadserver.com https://*.teads.tv https://*.upe.schwarz https://*.virtualearth.net https://*.youtube.com https://ads.yieldmo.com https://analytics.google.com https://api.scon-assets.schwarz https://asset.schwarz https://bidswitch.net https://c1.adform.net https://cdn.cookielaw.org https://cdn.flavedo.io https://ce.lijit.com https://cm.adform.net https://content.odj.cloud https://criteo-partners.tremorhub.com https://dpm.demdex.net https://e1.emxdgt.com https://eb2.3lift.com https://exchange.mediavine.com https://fast.nexx360.io https://form.lidl.com https://hb.yahoo.net https://id5-sync.com https://jadserve.postrelease.com https://lidl.de https://lidl.media.schwarz https://lidl.media01.eu https://lidlplusprod.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://matching.ivitrack.com https://media.sit-connect.com https://mycliplister.com https://pixel.rubiconproject.com https://region1.analytics.google.com https://rt.udmserve.net https://s.kelkoogroup.net https://s.seedtag.com https://searchhub.io https://sentry.int.secrz.com https://size.lidl.com https://spatial.virtualearth.net https://ssc-cms.33across.com https://sync-criteo.ads.yieldmo.com https://sync.1rx.io https://sync.go.sonobi.com https://sync.targeting.unrulymedia.com https://test.formcycle.vdc.lidl https://upeimagesprd.blob.core.windows.net https://www.adobe.com https://www.awin1.com https://www.google.at https://www.google.ba https://www.google.be https://www.google.bg https://www.google.ch https://www.google.co.uk https://www.google.com https://www.google.com.bd https://www.google.com.tr https://www.google.com.ua https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fr https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.se https://www.google.sk https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://www.w3.org https://x.bidswitch.net https://youtube.com; object-src 'self' 'unsafe-eval' https://*.batch.com https://*.cookiebot.com https://*.criteo.com https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.leaflets.schwarz https://*.lidl-shop.com https://*.lidl.de https://*.livebuy.io https://*.youtube.com https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://manuals.sit-connect.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com; report-uri https://csp-service.prod-varnish-ha-myra.lidl-shop.com/csp/report; script-src 'self' 'unsafe-eval' 'unsafe-inline' about: blob: https://*.adsrvr.org https://*.adyen.com https://*.api.schwarz https://*.app.baqend.com https://*.batch.com https://*.bing.com https://*.clarity.ms https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.exactag.com https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.friendlycaptcha.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.onetrust.com https://*.peakprotect.com https://*.pingdom.net https://*.scon.schwarz https://*.searchhub.io https://*.virtualearth.net https://*.youtube.com https://adservice.google.com https://asset.schwarz https://bidswitch.net https://cdn.cookielaw.org https://creativecdn.com https://form.lidl.com https://lidl.de https://lidl.media01.eu https://localhost https://mycliplister.com https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://region1.analytics.google.com https://s.kk-resources.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com; style-src 'self' 'unsafe-inline' https://*.app.baqend.com https://*.bing.com https://*.cookiebot.com https://*.criteo.com https://*.experimentation.dev https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.medallia.eu https://*.youtube.com https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://region1.analytics.google.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://youtube.com;
Directive Analysis
base-uriLOW
self
default-srcHIGH
self unsafe-inline blob: data: https://*.adsrvr.org https://*.adyen.com https://*.api.schwarz https://*.app.baqend.com https://*.assets.schwarz https://*.batch.com https://*.bing.com https://*.clarity.ms https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.exactag.com https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.frcapi.com https://*.friendlycaptcha.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.lidl.lt https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.onetrust.com https://*.peakprotect.com https://*.pingdom.net https://*.scon.schwarz https://*.simplesurance.com https://*.virtualearth.net https://*.youtube-nocookie.com https://*.youtube.com https://analytics.google.com https://asset.schwarz https://autosuggest.search.hereapi.com https://bat.bing.net https://bidswitch.net https://cdn.cookielaw.org https://creativecdn.com https://csp-service.prod-varnish-ha-myra.lidl-shop.com https://form.lidl.com https://google.com https://lidl.de https://lidl.media.schwarz https://lidl.media01.eu https://lidlplusprod.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://mycliplister.com https://region1.analytics.google.com https://s.kelkoogroup.net https://s.kk-resources.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://upeimagesprd.blob.core.windows.net https://www.awin1.com https://www.google.be https://www.google.com https://www.google.cz https://www.google.nl https://www.google.pl https://www.google.sk https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com wss://endpoint-prod.scon.schwarz
•Unsafe inline execution allowed in default-src
•HIGH RISK: 'blob:' URI in default-src allows script execution from dynamic blobs
•CRITICAL: 'data:' URI in default-src allows arbitrary JavaScript execution
form-actionLOW
self https://*.facebook.com https://*.facebook.net https://accounts.lidl.com https://payments.lidlplus.com https://survey.g.doubleclick.net
frame-ancestorsLOW
self https://*.lidl.com https://*.livebuy.io
frame-srcHIGH
self unsafe-inline https://*.adsrvr.org https://*.adyen.com https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.frcapi.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.lidl.lt https://*.livebuy.io https://*.medallia.eu https://*.pingdom.net https://*.youtube-nocookie.com https://*.youtube.com https://balancechecks.tx-gate.com https://bidswitch.net https://creativecdn.com https://form.lidl.com https://forms-prod.enc-test.de/ https://ldl.viewer.cit-fusion.com https://lidl.de https://lidl.media01.eu https://link.tink.com https://manuals.sit-connect.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-gewinnspiel.de https://www.youtube.com https://youtube.com
•Unsafe inline execution allowed in frame-src
img-srcHIGH
self unsafe-inline blob: data: https://*.360yield.com https://*.addthis.com https://*.adnxs.com https://*.adyen.com https://*.app.baqend.com https://*.assets.schwarz https://*.bing.com https://*.casalemedia.com https://*.cat-ret.assets.lidl https://*.cdn.flavedo.io https://*.clarity.ms https://*.cliplister.com https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-onlinenewsletter.de https://*.lidl-shop.com https://*.lidl.de https://*.lidl.lt https://*.lidlplus.com https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.retail.lidl.net https://*.retail.vdc.lidl https://*.searchhub.io https://*.smartadserver.com https://*.teads.tv https://*.upe.schwarz https://*.virtualearth.net https://*.youtube.com https://ads.yieldmo.com https://analytics.google.com https://api.scon-assets.schwarz https://asset.schwarz https://bidswitch.net https://c1.adform.net https://cdn.cookielaw.org https://cdn.flavedo.io https://ce.lijit.com https://cm.adform.net https://content.odj.cloud https://criteo-partners.tremorhub.com https://dpm.demdex.net https://e1.emxdgt.com https://eb2.3lift.com https://exchange.mediavine.com https://fast.nexx360.io https://form.lidl.com https://hb.yahoo.net https://id5-sync.com https://jadserve.postrelease.com https://lidl.de https://lidl.media.schwarz https://lidl.media01.eu https://lidlplusprod.blob.core.windows.net https://lidlplusstorage.blob.core.windows.net https://matching.ivitrack.com https://media.sit-connect.com https://mycliplister.com https://pixel.rubiconproject.com https://region1.analytics.google.com https://rt.udmserve.net https://s.kelkoogroup.net https://s.seedtag.com https://searchhub.io https://sentry.int.secrz.com https://size.lidl.com https://spatial.virtualearth.net https://ssc-cms.33across.com https://sync-criteo.ads.yieldmo.com https://sync.1rx.io https://sync.go.sonobi.com https://sync.targeting.unrulymedia.com https://test.formcycle.vdc.lidl https://upeimagesprd.blob.core.windows.net https://www.adobe.com https://www.awin1.com https://www.google.at https://www.google.ba https://www.google.be https://www.google.bg https://www.google.ch https://www.google.co.uk https://www.google.com https://www.google.com.bd https://www.google.com.tr https://www.google.com.ua https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fr https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.is https://www.google.it https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.se https://www.google.sk https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://www.w3.org https://x.bidswitch.net https://youtube.com
•Unsafe inline execution allowed in img-src
•Info: 'blob:' URI in img-src
•Info: 'data:' URI in img-src
object-srcHIGH
self unsafe-eval https://*.batch.com https://*.cookiebot.com https://*.criteo.com https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.leaflets.schwarz https://*.lidl-shop.com https://*.lidl.de https://*.livebuy.io https://*.youtube.com https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://manuals.sit-connect.com https://region1.analytics.google.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com
•Unsafe eval() execution allowed in object-src
report-uriLOW
https://csp-service.prod-varnish-ha-myra.lidl-shop.com/csp/report
•Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.
script-srcHIGH
self unsafe-eval unsafe-inline about: blob: https://*.adsrvr.org https://*.adyen.com https://*.api.schwarz https://*.app.baqend.com https://*.batch.com https://*.bing.com https://*.clarity.ms https://*.cookiebot.com https://*.creativecdn.com https://*.criteo.com https://*.doubleclick.net https://*.exactag.com https://*.experimentation.dev https://*.facebook.com https://*.facebook.net https://*.friendlycaptcha.com https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.instana.io https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.com https://*.lidl.de https://*.livebuy.io https://*.medallia.eu https://*.mycliplister.com https://*.onetrust.com https://*.peakprotect.com https://*.pingdom.net https://*.scon.schwarz https://*.searchhub.io https://*.virtualearth.net https://*.youtube.com https://adservice.google.com https://asset.schwarz https://bidswitch.net https://cdn.cookielaw.org https://creativecdn.com https://form.lidl.com https://lidl.de https://lidl.media01.eu https://localhost https://mycliplister.com https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://region1.analytics.google.com https://s.kk-resources.com https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.awin1.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://youtube.com
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobs
•No nonces or hashes used for script-src
style-srcHIGH
self unsafe-inline https://*.app.baqend.com https://*.bing.com https://*.cookiebot.com https://*.criteo.com https://*.experimentation.dev https://*.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.kameleoon.com https://*.kameleoon.eu https://*.kameleoon.io https://*.kampyle.com https://*.leaflets.schwarz https://*.lidl-flyer.com https://*.lidl-shop.com https://*.lidl.de https://*.medallia.eu https://*.youtube.com https://asset.schwarz https://bidswitch.net https://form.lidl.com https://lidl.de https://lidl.media01.eu https://partnersbenefits-uat-we.k8s.scrm.apps.schwarz https://region1.analytics.google.com https://sdk.virtualearth.net https://searchhub.io https://sentry.int.secrz.com https://spatial.virtualearth.net https://test.formcycle.vdc.lidl https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.lidl-shop.be https://www.lidl-shop.cz https://www.lidl-shop.nl https://www.lidl-shop.sk https://www.lidl-sklep.pl https://youtube.com
•Unsafe inline execution allowed in style-src
Missing Directives
⚠MEDIUMMissing MEDIUM directive connect-src (API/XHR control - prevents data exfiltration)
⚠MEDIUMMissing MEDIUM directive font-src (Font source control)
Security Headers
✗Cross-Origin-Opener-PolicyMissing
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
nginx
add_header Cross-Origin-Opener-Policy "same-origin" always;apache
Header always set Cross-Origin-Opener-Policy "same-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✗Referrer-PolicyMissing
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"✓Strict-Transport-SecurityPresent
max-age=63072000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
3 recommended security headers are missing on lidl.lt.
Issues Found
- •CRITICAL: 'data:' URI in default-src allows arbitrary JavaScript executioncritical
- •Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.info
- •HIGH RISK: 'blob:' URI in default-src allows script execution from dynamic blobshigh
- •HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobshigh
- •Info: 'blob:' URI in img-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Missing MEDIUM directive connect-src (API/XHR control - prevents data exfiltration)medium
- •Missing MEDIUM directive font-src (Font source control)medium
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: Permissions-Policymedium
- •Missing security header: Referrer-Policymedium
- •No nonces or hashes used for script-srcmedium
- •Unsafe eval() execution allowed in object-srchigh
- •Unsafe eval() execution allowed in script-srchigh
- •Unsafe inline execution allowed in default-srchigh
- •Unsafe inline execution allowed in frame-srchigh
- •Unsafe inline execution allowed in img-srchigh
- •Unsafe inline execution allowed in script-srchigh
- •Unsafe inline execution allowed in style-srchigh
Recommendations
- →Add connect-src directive with appropriate restrictions
- →Add font-src directive with appropriate restrictions
- →Consider implementing a stricter Content Security Policy
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about lidl.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
lidl.lt
3 scans since 7/16/2025
F
Latest: 32/100
Total Scans
3
Latest Score
32/100
First Scan
7/16/2025
Last Scan
7/8/2026
Security
32 / 100Significant security weaknesses detected in CSP configuration.
Compliance
66 / 100Several compliance gaps found in CSP implementation.
Best Practices
47 / 100Few best practices adopted — significant room for improvement.
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/lidl.lt" title="Security headers grade for lidl.lt — HeaderTest">
<img src="https://headertest.com/api/badge/lidl.lt" alt="HeaderTest security grade: F (32/100) for lidl.lt" />
</a>Markdown
[](https://headertest.com/results/lidl.lt)