Domain History
molnlycke.ee
Grade A+ · 90/100 · 5/6 security headers present
Security Score
A+
90/ 100
Security Headers
5/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'none'; child-src 'self' https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; connect-src 'self' data: http://ad.doubleclick.net https://*.googletagmanager.com https://*.onetrust.com https://*.tiktok.com https://adservice.google.com https://analytics.google.com https://analytics.tiktok.com https://assets-tracking.crazyegg.com https://cdn.cookielaw.org https://dc.services.visualstudio.com https://esp-eu.aptrinsic.com https://googleads.g.doubleclick.net https://molnlycke2gir36prod.dxcloud.episerver.net https://pagead2.googlesyndication.com https://pagestates-tracking.crazyegg.com https://px.ads.linkedin.com https://region1.analytics.google.com https://region1.google-analytics.com https://script.crazyegg.com https://server-side-tagging-tagkg43egq-uc.a.run.app https://stats.g.doubleclick.net https://tracking.crazyegg.com https://www.facebook.com https://www.google-analytics.com https://www.google.ae https://www.google.at https://www.google.be https://www.google.ca https://www.google.ch https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.kr https://www.google.co.ma https://www.google.co.th https://www.google.co.uk https://www.google.co.za https://www.google.com https://www.google.com.au https://www.google.com.br https://www.google.com.co https://www.google.com.cy https://www.google.com.eg https://www.google.com.hk https://www.google.com.mx https://www.google.com.my https://www.google.com.ph https://www.google.com.pk https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.tr https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.it https://www.google.nl https://www.google.no https://www.google.pl https://www.google.ro https://www.google.se https://www.googleadservices.com https://www.molnlycke.com/localization-admin-ui/*; font-src 'self' data: http://themes.googleusercontent.com https://*.cloudfront.net/graphik/ https://*.cloudfront.net/lato/ https://fonts.gstatic.com https://login.microsoftonline.com https://sc-static.net https://script.crazyegg.com https://svcs.tql.com https://www.molnlycke.com/localization-admin-ui/*; form-action 'self' https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; frame-src 'self' blob: http://*.opendns.com https://*.crazyegg.com https://*.opendns.com https://api.screen9.com https://dashboard.find.episerver.net https://script.crazyegg.com https://server-side-tagging-tagkg43egq-uc.a.run.app/ https://td.doubleclick.net https://www.facebook.com https://www.google.com https://www.googletagmanager.com https://www.molnlycke.com/localization-admin-ui/* https://www.youtube.com; img-src 'self' data: https://cdn.cookielaw.org https://connect.facebook.net https://fonts.gstatic.com https://googleads.g.doubleclick.net https://i.ytimg.com https://img.youtube.com https://login.microsoftonline.com https://minervablob.blob.core.windows.net https://pagead2.googlesyndication.com https://px.ads.linkedin.com https://script.crazyegg.com https://storage.googleapis.com https://translate.google.com https://www.facebook.com https://www.google.ae https://www.google.at https://www.google.be https://www.google.ca https://www.google.ch https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.nz https://www.google.co.th https://www.google.co.uk https://www.google.co.za https://www.google.com https://www.google.com.au https://www.google.com.br https://www.google.com.co https://www.google.com.cy https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.hk https://www.google.com.lb https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ph https://www.google.com.pk https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.tr https://www.google.com.tw https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fi https://www.google.fr https://www.google.hu https://www.google.ie https://www.google.iq https://www.google.it https://www.google.lv https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.rw https://www.google.se https://www.google.si https://www.googletagmanager.com https://www.molnlycke.com https://www.molnlycke.com/localization-admin-ui/*; media-src 'self' https://minervablob.blob.core.windows.net https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; script-src-elem 'self' 'unsafe-inline' https://*.crazyegg.com https://*.googletagmanager.com https://*.youtube.com https://analytics.tiktok.com https://cdn.cookielaw.org https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://code.jquery.com https://connect.facebook.net https://gc.kis.v2.scr.kaspersky-labs.com https://googleads.g.doubleclick.net https://js.monitor.azure.com https://js.monitor.azure.com/scripts/b/ai.2.gbl.min.js https://maxcdn.bootstrapcdn.com https://pagead2.googlesyndication.com https://sc-static.net https://script.crazyegg.com https://snap.licdn.com https://unpkg.com https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://web-sdk-eu.aptrinsic.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://www.gstatic.com https://www.molnlycke.com/localization-admin-ui/* https://www.youtube.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://cdn.cookielaw.org https://connect.facebook.net https://googleads.g.doubleclick.net https://js.monitor.azure.com https://js.monitor.azure.com/scripts/b/ai.2.gbl.min.js https://script.crazyegg.com https://unpkg.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.molnlycke.com/localization-admin-ui/* https://www.youtube.com; style-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com https://login.microsoftonline.com https://maxcdn.bootstrapcdn.com https://script.crazyegg.com https://web-sdk-eu.aptrinsic.com https://www.gstatic.com https://www.molnlycke.com/localization-admin-ui/*; style-src 'self' 'unsafe-inline' https://login.microsoftonline.com https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; style-src-attr 'unsafe-inline' https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; manifest-src https://molnlycke2gir36prod.dxcloud.episerver.net https://script.crazyegg.com https://www.molnlycke.com https://www.molnlycke.com/localization-admin-ui/*; frame-ancestors https://script.crazyegg.com https://www.molnlycke.com https://www.molnlycke.com/localization-admin-ui/*; base-uri https://script.crazyegg.com https://www.molnlycke.com https://www.molnlycke.com/localization-admin-ui/*; worker-src blob: https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; script-src-attr https://script.crazyegg.com https://www.google.com https://www.molnlycke.com/localization-admin-ui/*; object-src https://script.crazyegg.com https://www.molnlycke.com/localization-admin-ui/*; navigate-to https://www.molnlycke.com/localization-admin-ui/*; prefetch-src https://www.molnlycke.com/localization-admin-ui/*; report-to stott-security-endpoint;report-uri https://www.molnlycke.com/stott.security.optimizely/api/cspreporting/reporturiviolation/;
Directive Analysis
default-srcLOW
'none'
•Missing recommended values for default-src: self
child-srcLOW
https://www.molnlycke.com/localization-admin-ui/* 'self' https://script.crazyegg.com
•Unknown directive: child-src
connect-srcMEDIUM
https://www.google.co.kr https://www.google.com.tr https://www.google.iq http://ad.doubleclick.net 'self' data: https://www.google.ae https://*.onetrust.com https://adservice.google.com https://stats.g.doubleclick.net https://www.google.co.jp https://www.google.co.ma https://www.google.fr https://www.google.se https://tracking.crazyegg.com https://www.google.com.eg https://www.google.com.br https://www.google.com.au https://analytics.tiktok.com https://www.facebook.com https://www.google.co.uk https://region1.google-analytics.com https://www.google.com https://www.google.de https://*.tiktok.com https://analytics.google.com https://region1.analytics.google.com https://googleads.g.doubleclick.net https://www.google.co.th https://www.google.com.my https://www.google.pl https://www.google.dk https://www.google.com.qa https://www.google.nl https://www.google.cz https://www.google.be https://www.google.com.vn https://pagead2.googlesyndication.com https://www.google.com.pk https://dc.services.visualstudio.com https://esp-eu.aptrinsic.com https://www.google.fi https://www.google.com.sg https://molnlycke2gir36prod.dxcloud.episerver.net https://www.google.co.il https://www.google.hu https://pagestates-tracking.crazyegg.com https://script.crazyegg.com https://www.google.ch https://www.google.com.ph https://www.google.com.hk https://www.google.no https://www.google.co.in https://www.google.ie https://www.google-analytics.com https://www.google.it https://www.google.ca https://www.googleadservices.com https://www.molnlycke.com/localization-admin-ui/* https://www.google.at https://px.ads.linkedin.com https://server-side-tagging-tagkg43egq-uc.a.run.app https://www.google.es https://www.google.com.cy https://*.googletagmanager.com https://cdn.cookielaw.org https://www.google.co.za https://assets-tracking.crazyegg.com https://www.google.com.mx https://www.google.ro https://www.google.com.co https://www.google.com.sa
•Insecure HTTP source allowed in connect-src
•Missing recommended values for connect-src: self
font-srcMEDIUM
https://fonts.gstatic.com https://www.molnlycke.com/localization-admin-ui/* https://sc-static.net https://login.microsoftonline.com 'self' data: https://svcs.tql.com https://*.cloudfront.net/lato/ https://script.crazyegg.com https://*.cloudfront.net/graphik/ http://themes.googleusercontent.com
•Insecure HTTP source allowed in font-src
•Missing recommended values for font-src: self
form-actionLOW
https://www.molnlycke.com/localization-admin-ui/* 'self' https://script.crazyegg.com
•Missing recommended values for form-action: self
frame-srcMEDIUM
https://*.crazyegg.com https://*.opendns.com https://www.facebook.com https://server-side-tagging-tagkg43egq-uc.a.run.app/ https://www.molnlycke.com/localization-admin-ui/* https://td.doubleclick.net https://www.google.com https://www.youtube.com 'self' http://*.opendns.com https://www.googletagmanager.com blob: https://dashboard.find.episerver.net https://script.crazyegg.com https://api.screen9.com
•Insecure HTTP source allowed in frame-src
•Missing recommended values for frame-src: self
img-srcLOW
https://fonts.gstatic.com https://www.google.co.kr https://www.google.com.tr https://www.google.iq 'self' data: https://www.google.ae https://www.google.com.ec https://www.google.se https://www.google.co.jp https://www.google.fr https://www.google.co.ma https://www.google.com.eg https://minervablob.blob.core.windows.net https://www.google.com.br https://i.ytimg.com https://www.google.com.au https://connect.facebook.net https://www.facebook.com https://www.google.co.uk https://www.google.com https://www.google.de https://www.google.com.ng https://www.google.co.th https://www.google.com.my https://googleads.g.doubleclick.net https://www.google.com.lb https://www.google.pl https://www.google.si https://www.google.dk https://www.google.ru https://www.google.com.qa https://www.google.rs https://www.google.nl https://www.google.cz https://translate.google.com https://www.google.be https://pagead2.googlesyndication.com https://www.google.com.vn https://www.google.com.pk https://www.google.com.tw https://www.google.lv https://www.google.fi https://www.googletagmanager.com https://www.google.com.sg https://www.google.co.il https://www.google.hu https://www.google.com.ph https://script.crazyegg.com https://www.google.ch https://www.molnlycke.com https://www.google.com.hk https://www.google.no https://www.google.co.in https://www.google.com.gh https://www.google.ie https://www.google.it https://www.google.co.ke https://www.google.ca https://www.molnlycke.com/localization-admin-ui/* https://www.google.rw https://storage.googleapis.com https://www.google.at https://px.ads.linkedin.com https://login.microsoftonline.com https://www.google.pt https://www.google.es https://www.google.com.cy https://www.google.co.nz https://cdn.cookielaw.org https://www.google.co.za https://www.google.com.mx https://img.youtube.com https://www.google.ro https://www.google.com.co https://www.google.com.sa
•Missing recommended values for img-src: self
media-srcLOW
https://www.molnlycke.com/localization-admin-ui/* 'self' https://minervablob.blob.core.windows.net https://script.crazyegg.com
•Missing recommended values for media-src: self
script-src-elemHIGH
https://*.crazyegg.com https://sc-static.net https://code.jquery.com 'self' https://www.gstatic.com https://js.monitor.azure.com https://analytics.tiktok.com https://connect.facebook.net https://unpkg.com https://www.google.com https://maxcdn.bootstrapcdn.com 'unsafe-inline' https://googleads.g.doubleclick.net https://cdn.jsdelivr.net https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://www.youtube.com https://pagead2.googlesyndication.com https://*.youtube.com https://gc.kis.v2.scr.kaspersky-labs.com https://www.googletagmanager.com https://js.monitor.azure.com/scripts/b/ai.2.gbl.min.js https://script.crazyegg.com https://cdnjs.cloudflare.com https://www.googleadservices.com https://www.molnlycke.com/localization-admin-ui/* https://snap.licdn.com https://*.googletagmanager.com https://cdn.cookielaw.org https://web-sdk-eu.aptrinsic.com
•Unknown directive: script-src-elem
•Unsafe inline execution allowed in script-src-elem
script-srcHIGH
'unsafe-eval' https://connect.facebook.net https://www.molnlycke.com/localization-admin-ui/* https://www.youtube.com https://unpkg.com https://www.google.com 'self' https://www.googletagmanager.com https://cdn.cookielaw.org 'unsafe-inline' https://googleads.g.doubleclick.net https://www.gstatic.com https://js.monitor.azure.com/scripts/b/ai.2.gbl.min.js https://js.monitor.azure.com https://script.crazyegg.com
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: self, sha512-, sha256-, sha384-, nonce-
•No nonces or hashes used for script-src
style-src-elemHIGH
https://www.molnlycke.com/localization-admin-ui/* https://maxcdn.bootstrapcdn.com https://login.microsoftonline.com 'self' 'unsafe-inline' https://www.gstatic.com https://fonts.googleapis.com https://script.crazyegg.com https://cdn.jsdelivr.net https://web-sdk-eu.aptrinsic.com
•Unknown directive: style-src-elem
•Unsafe inline execution allowed in style-src-elem
style-srcHIGH
https://www.molnlycke.com/localization-admin-ui/* https://login.microsoftonline.com 'self' 'unsafe-inline' https://script.crazyegg.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: self, sha512-, sha256-, sha384-, nonce-
style-src-attrHIGH
'unsafe-inline' https://www.molnlycke.com/localization-admin-ui/* https://script.crazyegg.com
•Unknown directive: style-src-attr
•Unsafe inline execution allowed in style-src-attr
manifest-srcLOW
https://www.molnlycke.com/localization-admin-ui/* https://molnlycke2gir36prod.dxcloud.episerver.net https://script.crazyegg.com https://www.molnlycke.com
•Missing recommended values for manifest-src: self
frame-ancestorsLOW
https://www.molnlycke.com/localization-admin-ui/* https://script.crazyegg.com https://www.molnlycke.com
•Missing recommended values for frame-ancestors: self, none
base-uriLOW
https://www.molnlycke.com/localization-admin-ui/* https://script.crazyegg.com https://www.molnlycke.com
•Missing recommended values for base-uri: self, none
worker-srcLOW
https://www.molnlycke.com/localization-admin-ui/* blob: https://script.crazyegg.com
•Missing recommended values for worker-src: self, none
script-src-attrLOW
https://www.molnlycke.com/localization-admin-ui/* https://www.google.com https://script.crazyegg.com
•Unknown directive: script-src-attr
object-srcLOW
https://www.molnlycke.com/localization-admin-ui/* https://script.crazyegg.com
•Missing recommended values for object-src: none
navigate-toLOW
https://www.molnlycke.com/localization-admin-ui/*
•Unknown directive: navigate-to
prefetch-srcLOW
https://www.molnlycke.com/localization-admin-ui/*
•Unknown directive: prefetch-src
report-toLOW
stott-security-endpoint
report-uriLOW
https://www.molnlycke.com/stott.security.optimizely/api/cspreporting/reporturiviolation/
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
strict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=2592000; includeSubDomains
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on molnlycke.ee.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about molnlycke.eeWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
molnlycke.ee
3 scans since 7/19/2025
A+
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/19/2025
Last Scan
7/19/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/molnlycke.ee" title="Security headers grade for molnlycke.ee — HeaderTest">
<img src="https://headertest.com/api/badge/molnlycke.ee" alt="HeaderTest security grade: A+ (90/100) for molnlycke.ee" />
</a>Markdown
[](https://headertest.com/results/molnlycke.ee)