nour.net.sa
Grade B · 75/100 · 3/7 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
Security
75 / 100Good security foundation but some CSP hardening recommended.
Compliance
70 / 100Mostly compliant but some directives or headers are missing.
Best Practices
63 / 100Basic practices followed but missing important optimizations.
CSP Analysis
default-src 'self'; script-src 'self' 'unsafe-inline' https://js.hs-analytics.net https://js.hs-banner.com https://js.usemessages.com https://js.hscollectedforms.net https://snap.licdn.com https://www.googletagmanager.com https://www.google-analytics.com https://www.gstatic.com https://www.google.com https://www.google.com.sa; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https://js.hs-analytics.net https://js.hs-banner.com https://js.usemessages.com https://js.hscollectedforms.net https://api.hubapi.com https://forms.hsforms.com https://www.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://snap.licdn.com https://www.google.com https://www.google.com.sa; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://www.google.com.sa https://forms.hsforms.com; object-src 'none'; base-uri 'self'; form-action 'self' https://forms.hsforms.com; frame-ancestors 'self'; upgrade-insecure-requests;
Directive Analysis
Security Headers
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
add_header Cross-Origin-Opener-Policy "same-origin" always;Header always set Cross-Origin-Opener-Policy "same-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valueControls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add it:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Header always set Referrer-Policy "strict-origin-when-cross-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"max-age=31536000
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
3 recommended security headers are missing on nour.net.sa.
Issues Found
- •CRITICAL: 'https:' in img-src allows scripts from ANY HTTPS domaincritical
- •Info: 'blob:' URI in img-srcinfo
- •Info: 'data:' URI in font-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: Permissions-Policymedium
- •Missing security header: Referrer-Policymedium
- •No nonces or hashes used for script-srcmedium
- •Unsafe inline execution allowed in script-srchigh
- •Unsafe inline execution allowed in style-srchigh
Recommendations
- →Consider implementing a stricter Content Security Policy
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
nour.net.sa
1 scan since 7/21/2026
Latest: 75/100
Total Scans
1
Latest Score
75/100
First Scan
7/21/2026
Last Scan
7/21/2026
Security
75 / 100Good security foundation but some CSP hardening recommended.
Compliance
70 / 100Mostly compliant but some directives or headers are missing.
Best Practices
63 / 100Basic practices followed but missing important optimizations.
Scan History
| Date | Score | CSP | Headers | Issues | Action |
|---|---|---|---|---|---|
| Jul 21, 2026 | B (75) | Yes | 3/7 | 10 | View → |
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/nour.net.sa" title="Security headers grade for nour.net.sa — HeaderTest">
<img src="https://headertest.com/api/badge/nour.net.sa" alt="HeaderTest security grade: B (75/100) for nour.net.sa" />
</a>[](https://headertest.com/results/nour.net.sa)