Domain History
lku.lt
Grade A+ · 100/100 · 6/6 security headers present
Security Score
A+
100/ 100
Security Headers
6/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
frame-ancestors 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://widget.kloosive.com https://assets.mlcdn.com *.mailerlite.com https://cdn-cookieyes.com *.mxpnl.com https://challenges.cloudflare.com *.marksign.eu https://markid.eu https://cdn.amcharts.com https://connect.facebook.net https://code.jquery.com https://google-analytics.com *.googletagmanager.com https://graph.facebook.com https://js.facebook.com https://m.youtube.com https://neversettle.activehosted.com https://ssl.google-analytics.com https://tagmanager.google.com https://unpkg.com https://www.youtube.com https://www.google-analytics.com https://www.gstatic.com https://www.google.com *.googletagmanager.com https://static.cloudflareinsights.com https://play.google.com https://googleads.g.doubleclick.net *.mlcdn.com; style-src 'self' 'unsafe-inline' https://widget.kloosive.com *.mailerlite.com https://assets.mlcdn.com *.gstatic.com code.jquery.com fonts.googleapis.com tagmanager.google.com unpkg.com *.googletagmanager.com https://googleads.g.doubleclick.net connect.facebook.net; object-src 'self' *.mailerlite.com *.mlcdn.com; frame-src 'self' https://challenges.cloudflare.com *.facebook.com *.youtube.com connect.facebook.net www.youtube-nocookie.com www.google.com *.googletagmanager.com *.doubleclick.net *.mailerlite.com *.mlcdn.com; child-src 'self' *.facebook.com connect.facebook.net www.youtube.com www.google.com *.googletagmanager.com *.mailerlite.com *.mlcdn.com; img-src 'self' data: blob: https://cdn-cookieyes.com *.googleusercontent.com *.openstreetmap.org *.w.org *.s.w.org *.doubleclick.net *.facebook.com *.facebook.net *.fbcdn.net *.google-analytics.com *.google.lt *.google.com *.ytimg.com *.youtube.com api.mapbox.com code.jquery.com fonts.gstatic.com unpkg.com *.googletagmanager.com https://googleads.g.doubleclick.net *.mailerlite.com connect.facebook.net *.mlcdn.com; font-src 'self' data: https://widget.kloosive.com *.mailerlite.com fonts.googleapis.com fonts.gstatic.com unpkg.com *.mlcdn.com; connect-src https://api.kloosive.com https://widget.kloosive.com https://cdn-cookieyes.com *.cookieyes.com *.mixpanel.com https://eparaiska.lt/analytics/pageview *.facebook.com *.google.com connect.facebook.net code.jquery.com eparaiska.lku.lt *.eparaiska.lt fonts.gstatic.com fonts.googleapis.com stats.g.doubleclick.net *.google-analytics.com *.googletagmanager.com yoast.com *.mlcdn.com *.mailerlite.com 'self'; manifest-src 'self'; base-uri 'self'; form-action 'self' *.facebook.com connect.facebook.net *.mailerlite.com mailerlite.com *.mlcdn.com; media-src 'self' *.mailerlite.com; worker-src 'self' blob: *.lku.lt; prefetch-src 'self' lku.lt
Directive Analysis
frame-ancestorsLOW
'self'
•Missing recommended values for frame-ancestors: none, self
default-srcLOW
'self'
•Missing recommended values for default-src: self
script-srcHIGH
https://widget.kloosive.com *.mxpnl.com https://code.jquery.com 'unsafe-inline' https://cdn-cookieyes.com https://static.cloudflareinsights.com https://www.google-analytics.com https://graph.facebook.com *.mailerlite.com https://m.youtube.com https://connect.facebook.net https://ssl.google-analytics.com https://play.google.com https://www.gstatic.com https://neversettle.activehosted.com 'self' https://googleads.g.doubleclick.net *.marksign.eu https://markid.eu 'unsafe-eval' https://tagmanager.google.com https://unpkg.com https://js.facebook.com https://www.youtube.com https://www.google.com *.mlcdn.com https://google-analytics.com *.googletagmanager.com https://cdn.amcharts.com https://assets.mlcdn.com https://challenges.cloudflare.com
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha256-, nonce-, sha512-, sha384-, self
•No nonces or hashes used for script-src
style-srcHIGH
code.jquery.com https://widget.kloosive.com tagmanager.google.com connect.facebook.net 'self' *.mailerlite.com 'unsafe-inline' fonts.googleapis.com https://googleads.g.doubleclick.net *.googletagmanager.com unpkg.com https://assets.mlcdn.com *.gstatic.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, nonce-, sha512-, sha384-, self
object-srcLOW
*.mlcdn.com 'self' *.mailerlite.com
•Missing recommended values for object-src: none
frame-srcLOW
*.doubleclick.net *.mlcdn.com connect.facebook.net 'self' www.youtube-nocookie.com www.google.com *.mailerlite.com *.googletagmanager.com *.facebook.com https://challenges.cloudflare.com *.youtube.com
•Missing recommended values for frame-src: self
child-srcLOW
*.mlcdn.com connect.facebook.net 'self' www.google.com *.mailerlite.com *.googletagmanager.com www.youtube.com *.facebook.com
•Unknown directive: child-src
img-srcLOW
*.s.w.org https://cdn-cookieyes.com *.fbcdn.net *.openstreetmap.org unpkg.com *.google-analytics.com connect.facebook.net data: *.mailerlite.com code.jquery.com 'self' *.google.lt https://googleads.g.doubleclick.net *.facebook.com *.youtube.com *.googleusercontent.com *.doubleclick.net *.facebook.net *.mlcdn.com fonts.gstatic.com *.googletagmanager.com blob: *.w.org api.mapbox.com *.google.com *.ytimg.com
•Missing recommended values for img-src: self
font-srcLOW
https://widget.kloosive.com *.mlcdn.com 'self' fonts.gstatic.com *.mailerlite.com data: unpkg.com fonts.googleapis.com
•Missing recommended values for font-src: self
connect-srcLOW
https://widget.kloosive.com *.cookieyes.com https://cdn-cookieyes.com https://api.kloosive.com yoast.com *.google-analytics.com *.google.com connect.facebook.net https://eparaiska.lt/analytics/pageview *.mailerlite.com *.eparaiska.lt fonts.googleapis.com code.jquery.com *.mixpanel.com 'self' eparaiska.lku.lt *.facebook.com *.mlcdn.com fonts.gstatic.com *.googletagmanager.com stats.g.doubleclick.net
•Missing recommended values for connect-src: self
manifest-srcLOW
'self'
•Missing recommended values for manifest-src: self
base-uriLOW
'self'
•Missing recommended values for base-uri: none, self
form-actionLOW
*.mlcdn.com mailerlite.com connect.facebook.net 'self' *.mailerlite.com *.facebook.com
•Missing recommended values for form-action: self
media-srcLOW
'self' *.mailerlite.com
•Missing recommended values for media-src: self
worker-srcLOW
*.lku.lt 'self' blob:
•Missing recommended values for worker-src: none, self
prefetch-srcLOW
'self' lku.lt
•Unknown directive: prefetch-src
Security Headers
✓Permissions-PolicyPresent
vibrate(self), usermedia(*), microphone(none), sync-xhr(self 'lku.lt')
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
✓Referrer-PolicyPresent
strict-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=63072000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
sameorigin
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about lku.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
lku.lt
2 scans since 7/16/2025
A+
Latest: 100/100
Total Scans
2
Latest Score
100/100
First Scan
7/16/2025
Last Scan
7/16/2025
Scan History
| Date | Score | CSP | Headers | Issues | Action |
|---|---|---|---|---|---|
| Jul 16, 2025 | A+ (100) | No | 6/6 | 0 | View → |
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/lku.lt" title="Security headers grade for lku.lt — HeaderTest">
<img src="https://headertest.com/api/badge/lku.lt" alt="HeaderTest security grade: A+ (100/100) for lku.lt" />
</a>Markdown
[](https://headertest.com/results/lku.lt)