pjvf.me
Grade A · 82/100 · 5/7 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
Security
82 / 100Good security foundation but some CSP hardening recommended.
Compliance
52 / 100Several compliance gaps found in CSP implementation.
Best Practices
65 / 100Basic practices followed but missing important optimizations.
CSP Analysis
default-src 'self'; style-src 'sha256-Y2u+hnH63Kh1nzKq2TvlIuTK5VY9qqipABMzObrJJj0=' 'sha256-2vvIkm/UcFZVnBdXGMlkteFT2evIzchZBC4tKOhBXC8=' 'sha256-hGp/oQkK/B7bWcrCFf+HPsGeWmVskv856Rxa/98NNQ4=' 'sha256-Qsqp+WS5Xi1Is5CgZPys5i7h10TbiLf/r2b4MANwseE=' 'sha256-8YfoMRrq/gCX/Xzv9b89NFeyfOtBXqtF9W43FZMvzes=' 'sha256-+bWoycOFfljYDiNFueCMgP6hN3e1KznCOSYLHccJGOA=' ; script-src 'strict-dynamic' 'sha256-6rqwSY8n1mhWomCb/+J7g4naNWko9rXh8HYOuhF6QtE=' 'sha256-EFr0qqG/n8hMKBJJPwfQQtVikPbm4UThPl4eX2U86DE=' 'sha256-wWz85s5o+N3+Ste9NoWhLgLFli+M0kKlXgHWARal1yc=' 'sha256-CcjKULJnd6UybkZW2FxBiCX6A/NPeNxeobRPAkDbH+M=' 'sha256-Iwx2C9CFPJ3OvdGKeA2pcOM2zQChyNAN+9IDKaPWNYs=' 'sha256-QlH4FYbBGnfhlbc85/JpZRzi3CybzSsOIrlhzv+Z5bo=' 'sha256-JaxuMuYypU4s5DsoFkOc/03qUaC+F6KTuWkBiGyJsS4=' 'sha256-VQf4VvsbWJM15SDGy6udnpIwoJoDMFFOMkslIy5rve0=' 'sha256-Cz2ybdi8tLlgbL6UeqQo+qqTAriyVjgxKStkhBGYxqU=' 'sha256-Vjg3Uuj9WYuNsI7PJgTZkh8Doprfor4eYdKUEU9fNus=' 'report-sha256'; font-src 'self'; img-src 'self'; form-action 'self'; connect-src https://comments.pjvf.me/*; frame-ancestors 'none'; base-uri 'none'; require-trusted-types-for 'script';
Directive Analysis
Missing Directives
Strict-Dynamic Analysis
Security Headers
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
add_header Cross-Origin-Opener-Policy "same-origin" always;Header always set Cross-Origin-Opener-Policy "same-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"interest-cohort=()
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
strict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
max-age=31536000;
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
DENY
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on pjvf.me.
Issues Found
- •Missing HIGH directive object-src (Plugin control - should be 'none')high
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Whitelist entries ["report-sha256"]... are ignored when strict-dynamic is present (CSP3 behavior)medium
Recommendations
- →Add object-src directive with appropriate restrictions
- →CSP is in Report-Only mode - policy violations are logged but NOT blocked. Deploy Content-Security-Policy header (not Report-Only) to enforce protection.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
pjvf.me
3 scans since 9/18/2026
Latest: 82/100
Total Scans
3
Latest Score
82/100
First Scan
9/18/2026
Last Scan
9/22/2026
Security
82 / 100Good security foundation but some CSP hardening recommended.
Compliance
52 / 100Several compliance gaps found in CSP implementation.
Best Practices
65 / 100Basic practices followed but missing important optimizations.
Score Trend
Security score progression over 3 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/pjvf.me" title="Security headers grade for pjvf.me — HeaderTest">
<img src="https://headertest.com/api/badge/pjvf.me" alt="HeaderTest security grade: A (82/100) for pjvf.me" />
</a>[](https://headertest.com/results/pjvf.me)