Domain History

porsche.lt

Grade D · 50/100 · 1/6 security headers present

Security Score

50/ 100

Security Headers

1/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH

default-src 'self' blob: cdn.moengage.com app-cdn.moengage.com sdk-01.moengage.com sdk-02.moengage.com sdk-03.moengage.com sdk-04.moengage.com wss://umd.userlike.com/ www.connectcdk.com ct.pinterest.com s.pinimg.com *.drivecentric.io *.mountain.com 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 gubagoo.io *.gubagoo.io *.analytics.google.com/ *.autouncle.de *.aws.porsche-preview.cloud/ *.aws.porsche.cloud/ *.clarity.ms *.cloudfront.net *.doubleclick.net *.facebook.com *.fls.doubleclick.net *.google-analytics.com/ *.google.ad *.google.ae *.google.al *.google.am *.google.as *.google.at *.google.az *.google.ba *.google.be *.google.bf *.google.bg *.google.bi *.google.bj *.google.bs *.google.bt *.google.by *.google.ca *.google.cat *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.co.ao *.google.co.bw *.google.co.ck *.google.co.cr *.google.co.id *.google.co.il *.google.co.in *.google.co.jp *.google.co.ke *.google.co.kr *.google.co.ls *.google.co.ma *.google.co.mz *.google.co.nz *.google.co.th *.google.co.tz *.google.co.ug *.google.co.uk *.google.co.uz *.google.co.ve *.google.co.vi *.google.co.za *.google.co.zm *.google.co.zw *.google.com *.google.com.af *.google.com.ag *.google.com.ar *.google.com.au *.google.com.bd *.google.com.bh *.google.com.bn *.google.com.bo *.google.com.br *.google.com.bz *.google.com.co *.google.com.cu *.google.com.cy *.google.com.do *.google.com.ec *.google.com.eg *.google.com.et *.google.com.fj *.google.com.gh *.google.com.gi *.google.com.gt *.google.com.hk *.google.com.jm *.google.com.kh *.google.com.kw *.google.com.lb *.google.com.ly *.google.com.mm *.google.com.mt *.google.com.mx *.google.com.my *.google.com.na *.google.com.ng *.google.com.ni *.google.com.np *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.com.pr *.google.com.py *.google.com.qa *.google.com.sa *.google.com.sb *.google.com.sg *.google.com.sl *.google.com.sv *.google.com.tj *.google.com.tr *.google.com.tw *.google.com.ua *.google.com.uy *.google.com.vc *.google.com.vn *.google.cv *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.dz *.google.ee *.google.es *.google.fi *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.gl *.google.gm *.google.gr *.google.gy *.google.hn *.google.hr *.google.ht *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kg *.google.ki *.google.kz *.google.la *.google.li *.google.lk *.google.lt *.google.lu *.google.lv *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.mv *.google.mw *.google.ne *.google.nl *.google.no *.google.nr *.google.nu *.google.pl *.google.pn *.google.ps *.google.pt *.google.ro *.google.rs *.google.ru *.google.rw *.google.sc *.google.se *.google.sh *.google.si *.google.sk *.google.sm *.google.sn *.google.so *.google.sr *.google.st *.google.td *.google.tg *.google.tl *.google.tm *.google.tn *.google.to *.google.tt *.google.vu *.google.ws *.googleadservices.com *.googletagmanager.com *.hcaptcha.com *.porsche-preview.cn *.porsche-preview.com *.porsche.cn *.porsche.com *.qualtrics.com tags.tiqcdn.com tags.tiqcdn.cn tags-eu.tiqcdn.com *.storystream.ai *.usercentrics.eu *.userlike.com ad.doubleclick.net adservice.google.com analytics.tiktok.com api.drivecentric.com assets.autouncle.com assets.prod.analytics.dealer.com bat.bing.com c.bing.com c.clarity.ms cm.teads.tv connect.facebook.net d.adroll.com dealership3d.com dealership3d.s3.ap-southeast-2.amazonaws.com edge.fullstory.com edge.eu1.fullstory.com files.superchat.de fledge.teads.tv ftm.fluencyinc.co/ftm-ddc.js googleads.g.doubleclick.net https://js-agent.newrelic.com/ http://cdn.ui.porsche.com/ https://app.carnow.com/ https://cdn.gubagoo.io https://config.eu.usercentrics.eu https://hcaptcha.com https://maps.googleapis.com https://pixall.esm1.net https://porsche.com https://static.app.carnow.com https://themes.static.app.carnow.com https://sync.graph.bluecava.com https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://userlike-cdn-umm.b-cdn.net https://userlike-cdn-widgets.s3-eu-west-1.amazonaws.com idsync.rlcdn.com ignitify-insite-scripts.drivecentric.io ignitify-insite.drivecentric.io ignitify-tagmanager-scripts.drivecentric.io ignitify-tagmanager.drivecentric.io img06.en25.com o2.eyereturn.com p.teads.tv pixel.mathtag.com *.linkedin.com r.turn.com rs.fullstory.com rs.eu1.fullstory.com s.adroll.com sc-static.net script.crazyegg.com scripts.foureyes.io snap.licdn.com stags.bluekai.com static-tracking.klaviyo.com static.klaviyo.com static.matterport.com t.teads.tv tags.bkrtx.com tags.bluekai.com tags.srv.stackadapt.com td.doubleclick.net tr.snapchat.com tr6.snapchat.com tracking.crazyegg.com unpkg.com ut.foureyes.io v.clarity.ms videochat.mobilapp.io widget.superchat.de widgets.binotel.com 'unsafe-inline' 'unsafe-eval' https://apps.sitecore.net bam.nr-data.net my.tealiumiq.com evt.autouncle.com bat.bing.net wss://node.gubagoo.io cdn.carfilmapp.com *.adform.net; img-src 'self' blob: moe-email-campaigns.s3.amazonaws.com image.moengage.com images-porsche.imgix.net bat.bing.net fra1.qualtrics.com siteintercept.qualtrics.com i.ytimg.com https://userlike-cdn-operators.userlike.com/ gubagoo.io *.gubagoo.io *.aws.porsche.cloud/ *.aws.porsche-preview.cloud/ *.autouncle.de *.clarity.ms *.cloudfront.net *.doubleclick.net/ *.facebook.com *.fls.doubleclick.net *.ggpht.com *.google-analytics.com/ *.google.ad *.google.ae *.google.al *.google.am *.google.as *.google.at *.google.az *.google.ba *.google.be *.google.bf *.google.bg *.google.bi *.google.bj *.google.bs *.google.bt *.google.by *.google.ca *.google.cat *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.co.ao *.google.co.bw *.google.co.ck *.google.co.cr *.google.co.id *.google.co.il *.google.co.in *.google.co.jp *.google.co.ke *.google.co.kr *.google.co.ls *.google.co.ma *.google.co.mz *.google.co.nz *.google.co.th *.google.co.tz *.google.co.ug *.google.co.uk *.google.co.uz *.google.co.ve *.google.co.vi *.google.co.za *.google.co.zm *.google.co.zw *.google.com *.google.com.af *.google.com.ag *.google.com.ar *.google.com.au *.google.com.bd *.google.com.bh *.google.com.bn *.google.com.bo *.google.com.br *.google.com.bz *.google.com.co *.google.com.cu *.google.com.cy *.google.com.do *.google.com.ec *.google.com.eg *.google.com.et *.google.com.fj *.google.com.gh *.google.com.gi *.google.com.gt *.google.com.hk *.google.com.jm *.google.com.kh *.google.com.kw *.google.com.lb *.google.com.ly *.google.com.mm *.google.com.mt *.google.com.mx *.google.com.my *.google.com.na *.google.com.ng *.google.com.ni *.google.com.np *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.com.pr *.google.com.py *.google.com.qa *.google.com.sa *.google.com.sb *.google.com.sg *.google.com.sl *.google.com.sv *.google.com.tj *.google.com.tr *.google.com.tw *.google.com.ua *.google.com.uy *.google.com.vc *.google.com.vn *.google.cv *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.dz *.google.ee *.google.es *.google.fi *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.gl *.google.gm *.google.gr *.google.gy *.google.hn *.google.hr *.google.ht *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kg *.google.ki *.google.kz *.google.la *.google.li *.google.lk *.google.lt *.google.lu *.google.lv *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.mv *.google.mw *.google.ne *.google.nl *.google.no *.google.nr *.google.nu *.google.pl *.google.pn *.google.ps *.google.pt *.google.ro *.google.rs *.google.ru *.google.rw *.google.sc *.google.se *.google.sh *.google.si *.google.sk *.google.sm *.google.sn *.google.so *.google.sr *.google.st *.google.td *.google.tg *.google.tl *.google.tm *.google.tn *.google.to *.google.tt *.google.vu *.google.ws *.googleadservices.com *.googleapis.com/ *.googletagmanager.com *.gstatic.com *.porsche-preview.cn *.porsche-preview.com *.porsche.cn *.porsche.com *.usercentrics.eu ad.doubleclick.net adservice.google.com analytics.tiktok.com api.drivecentric.com assets.autouncle.com assets.prod.analytics.dealer.com bat.bing.com c.bing.com c.clarity.ms cm.teads.tv connect.facebook.net d.adroll.com dealership3d.com dealership3d.s3.ap-southeast-2.amazonaws.com edge.fullstory.com edge.eu1.fullstory.com files.superchat.de fledge.teads.tv googleads.g.doubleclick.net http://cdn.ui.porsche.com/ idsync.rlcdn.com ignitify-insite-scripts.drivecentric.io ignitify-insite.drivecentric.io ignitify-tagmanager-scripts.drivecentric.io ignitify-tagmanager.drivecentric.io img06.en25.com o2.eyereturn.com p.teads.tv pixel.mathtag.com *.linkedin.com r.turn.com rs.fullstory.com rs.eu1.fullstory.com s.adroll.com s1755874914.t.eloqua.com script.crazyegg.com scripts.foureyes.io snap.licdn.com stags.bluekai.com static-tracking.klaviyo.com static.klaviyo.com static.matterport.com t.teads.tv tags.bkrtx.com tags.bluekai.com tags.srv.stackadapt.com td.doubleclick.net tr.snapchat.com tr6.snapchat.com unpkg.com ut.foureyes.io v.clarity.ms videochat.mobilapp.io widget.superchat.de widgets.binotel.com static.app.carnow.com data:; style-src 'self' cdn.moengage.com app-cdn.moengage.com fonts.bunny.net assets.autouncle.com *.cloudfront.net *.porsche-preview.cn *.porsche-preview.com *.porsche.cn *.porsche.com api.drivecentric.com *.googletagmanager.com tags.srv.stackadapt.com themes.static.app.carnow.com 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: assets.autouncle.com fonts.bunny.net https://userlike-cdn-umm.b-cdn.net/ *.porsche.cn *.porsche.com *.cloudfront.net *.porsche-preview.cn *.porsche-preview.com 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content; frame-ancestors 'self'; frame-src 'self' blob: www.connectcdk.com privacyportal.onetrust.com porsche-emails-v2.s3.eu-west-2.amazonaws.com *.accelerate.dealer.com *.autouncle.de *.clarity.ms *.creditbureauconnection.com *.doubleclick.net/ *.facebook.com *.fls.doubleclick.net *.google.com *.google.de *.googleadservices.com *.googletagmanager.com *.hcaptcha.com/ *.porsche-preview.cn *.porsche-preview.com *.porsche.cn *.porsche.com *.usercentrics.eu/ ad.doubleclick.net adservice.google.com analytics.tiktok.com api.drivecentric.com assets.autouncle.com assets.prod.analytics.dealer.com bat.bing.com c.bing.com c.clarity.ms cm.teads.tv connect.facebook.net cs.esm1.net d.adroll.com dealership3d.com dealership3d.s3.ap-southeast-2.amazonaws.com edge.fullstory.com edge.eu1.fullstory.com files.superchat.de fledge.teads.tv googleads.g.doubleclick.net https://app.carnow.com/ https://consumer.xtime.com/ https://creditbureauconnection.com https://pauc.syndication.kbb.com/ https://porsche.com https://static.app.carnow.com https://sync.graph.bluecava.com idsync.rlcdn.com ignitify-insite-scripts.drivecentric.io ignitify-insite.drivecentric.io ignitify-tagmanager-scripts.drivecentric.io ignitify-tagmanager.drivecentric.io img06.en25.com o2.eyereturn.com p.teads.tv pixel.mathtag.com *.linkedin.com r.turn.com rs.fullstory.com rs.eu1.fullstory.com s.adroll.com script.crazyegg.com scripts.foureyes.io snap.licdn.com stags.bluekai.com static-tracking.klaviyo.com static.klaviyo.com static.matterport.com t.teads.tv tags.bkrtx.com tags.bluekai.com tags.srv.stackadapt.com td.doubleclick.net tr.snapchat.com tr6.snapchat.com unpkg.com ut.foureyes.io v.clarity.ms videochat.mobilapp.io widget.superchat.de widgets.binotel.com *.youtube.com app-prod.flipacar.com e.issuu.com fca1.wpengine.com conscheduling.tekioncloud.com player.vimeo.com consumer.xtime.net.au www.cognitoforms.com api.connectcdk.com gain-vi.ca www.youtube-nocookie.com porsche-production.discover.chargetrip.com suite.dtdrs.dealertrack.com porsche-shared.vercel.app gaudinmotorcompany.bamboohr.com ct.pinterest.com cdn.moengage.com m.xtime.com *.adform.net;

Directive Analysis

default-srcHIGH

*.google.com.ag *.google.mv widget.superchat.de *.google.com.vn *.google.md assets.autouncle.com *.google.com.bh o2.eyereturn.com www.connectcdk.com *.google.am assets.prod.analytics.dealer.com *.google.no *.google.hr *.google.gg tags.srv.stackadapt.com *.google.com.lb *.google.is *.drivecentric.io *.google.ht *.porsche.cn *.google.com.py *.google.com.tj *.google.si *.google.bi pixel.mathtag.com *.google.hn *.google.pn *.userlike.com *.google.ge *.google.com.np *.clarity.ms *.google.com.kh p.teads.tv *.google.bj gubagoo.io *.google.es 'unsafe-inline' *.google.al *.google.rw *.google.li *.google.co.uk *.google.pl *.google.sh *.google.co.ma static.klaviyo.com img06.en25.com *.doubleclick.net *.google.com.sa *.google.td widgets.binotel.com tr6.snapchat.com *.google.com.mm *.google.at *.google.com.ar *.google.com.my ignitify-insite-scripts.drivecentric.io *.google.com.sl *.analytics.google.com/ *.google.com.ua https://js-agent.newrelic.com/ *.google.com.ni tracking.crazyegg.com tags-eu.tiqcdn.com https://userlike-cdn-umm.b-cdn.net ad.doubleclick.net 52.22.50.55 *.google.me *.google.nu *.google.com.au *.google.gr *.google.fi *.cloudfront.net *.fls.doubleclick.net *.google.it *.google.co.ke https://porsche.com adservice.google.com *.google.tl *.google.co.tz s.pinimg.com *.google.bf *.google.com.pr *.google.co.bw *.google.je *.google.com.sb *.google.by static-tracking.klaviyo.com tags.tiqcdn.com bat.bing.com ut.foureyes.io http://cdn.ui.porsche.com/ *.google.com.kw ct.pinterest.com *.google.iq sdk-01.moengage.com *.google.lu *.google.com.bn *.google.com.bz *.google.co.cr 35.85.84.151 https://sync.graph.bluecava.com *.google.co.th tr.snapchat.com *.google.co.jp *.google.mn *.google.com.cu https://maps.googleapis.com *.google.be *.google.com.br *.google.ba *.google.com.sg td.doubleclick.net *.google.la *.google.co.zm c.bing.com *.google.gm *.google.mw tags.tiqcdn.cn *.google.kg *.google.sr cdn.moengage.com *.google-analytics.com/ *.facebook.com cm.teads.tv *.google.com.tr *.googletagmanager.com *.google.fm *.storystream.ai https://config.eu.usercentrics.eu r.turn.com cdn.carfilmapp.com *.google.lk *.google.bs *.google.com.om *.gubagoo.io *.google.com.fj *.google.cat *.google.co.za *.google.bt *.google.co.ls *.google.ee s.adroll.com tags.bkrtx.com *.google.bg *.porsche-preview.com *.google.sm *.google.de *.google.com.co https://cdn.gubagoo.io *.google.co.il *.google.ie https://themes.static.app.carnow.com 3.212.39.155 static.matterport.com 34.215.155.61 *.google.co.nz *.google.dz *.google.cl https://apps.sitecore.net files.superchat.de sc-static.net my.tealiumiq.com *.google.co.uz *.google.jo *.google.com.pg *.google.com.ec *.google.com.na *.google.co.ck dealership3d.s3.ap-southeast-2.amazonaws.com bam.nr-data.net *.google.co.ug *.google.com.ph *.google.dk *.google.pt *.google.gy *.google.ga *.google.dm *.google.com.pe bat.bing.net *.google.kz *.google.tt 44.228.85.26 18.210.229.244 *.google.co.id *.linkedin.com *.google.co.vi *.google.sc idsync.rlcdn.com *.google.com.gh 35.160.46.251 *.google.com *.google.com.af t.teads.tv *.google.ad *.google.com.mt script.crazyegg.com *.google.com.ly https://userlike-cdn-widgets.s3-eu-west-1.amazonaws.com wss://node.gubagoo.io *.qualtrics.com *.google.ch *.google.ci app-cdn.moengage.com *.google.ca api.drivecentric.com edge.eu1.fullstory.com sdk-02.moengage.com 100.20.58.101 *.aws.porsche-preview.cloud/ *.google.com.bo snap.licdn.com *.google.cz *.google.co.mz *.google.ki *.google.cf *.google.gl *.google.tn *.porsche.com *.google.ne *.google.com.mx *.google.so *.google.com.qa 54.156.2.105 *.autouncle.de ftm.fluencyinc.co/ftm-ddc.js stags.bluekai.com *.google.tm *.google.com.et unpkg.com sdk-04.moengage.com 'self' *.google.com.sv *.google.az tags.bluekai.com *.google.com.hk fledge.teads.tv https://static.app.carnow.com d.adroll.com *.google.ws https://pixall.esm1.net rs.fullstory.com *.google.mk *.google.com.do *.google.cd *.google.co.ve googleads.g.doubleclick.net *.google.cg *.google.com.gt *.google.lt *.google.com.tw videochat.mobilapp.io *.google.to *.google.tg *.aws.porsche.cloud/ *.googleadservices.com connect.facebook.net edge.fullstory.com *.google.fr sdk-03.moengage.com *.google.nr *.google.ro *.google.im analytics.tiktok.com ignitify-insite.drivecentric.io *.google.co.in *.google.as dealership3d.com wss://umd.userlike.com/ 44.212.189.233 https://app.carnow.com/ *.google.com.gi *.google.st *.google.co.ao *.google.ml *.hcaptcha.com ignitify-tagmanager-scripts.drivecentric.io *.porsche-preview.cn c.clarity.ms blob: *.google.com.jm *.google.sk https://hcaptcha.com *.google.sn *.google.rs *.google.cn v.clarity.ms *.google.com.uy 'unsafe-eval' 44.238.122.172 *.google.lv *.google.mu *.google.cv *.google.co.kr rs.eu1.fullstory.com *.google.co.zw *.google.ae evt.autouncle.com *.google.com.pa *.google.ps ignitify-tagmanager.drivecentric.io *.google.com.pk *.google.ru scripts.foureyes.io *.adform.net https://unpkg.com/web-vitals/dist/web-vitals.iife.js *.google.se *.usercentrics.eu *.google.vu *.google.hu *.google.com.vc *.google.com.ng *.google.nl *.google.dj *.google.com.cy *.google.cm 52.71.121.170 *.google.com.bd *.google.mg *.google.com.eg *.mountain.com

•Unsafe inline execution allowed in default-src

•Insecure HTTP source allowed in default-src

•Unsafe eval() execution allowed in default-src

•Missing recommended values for default-src: self

img-srcMEDIUM

*.google.co.uz *.google.com.ag *.google.jo *.google.com.pg *.google.mv *.google.az *.google.com.ec tags.bluekai.com *.google.com.na *.google.it *.google.com.hk fledge.teads.tv widget.superchat.de *.google.co.ke *.google.com.vn *.google.md *.google.co.ck *.google.com.bh adservice.google.com assets.autouncle.com dealership3d.s3.ap-southeast-2.amazonaws.com *.google.tl *.google.co.tz *.gstatic.com *.google.bf *.google.co.ug *.google.com.ph images-porsche.imgix.net *.google.com.pr *.google.dk *.google.gy *.google.pt *.google.ga d.adroll.com *.google.co.bw o2.eyereturn.com *.google.ws *.google.dm rs.fullstory.com *.google.com.pe *.google.je *.google.com.do *.google.am *.google.cd *.google.com.sb *.google.co.ve *.google.mk bat.bing.net *.google.no assets.prod.analytics.dealer.com googleads.g.doubleclick.net *.google.kz moe-email-campaigns.s3.amazonaws.com *.google.cg *.google.by *.google.hr static-tracking.klaviyo.com bat.bing.com *.google.com.gt *.google.lt ut.foureyes.io *.google.tt http://cdn.ui.porsche.com/ *.google.gg *.google.com.kw siteintercept.qualtrics.com tags.srv.stackadapt.com data: *.google.com.tw *.google.com.lb videochat.mobilapp.io *.google.co.id *.google.iq *.google.to *.google.tg *.aws.porsche.cloud/ *.google.lu *.linkedin.com *.google.com.bn *.google.is *.googleadservices.com connect.facebook.net edge.fullstory.com *.google.com.bz *.google.co.cr *.google.co.vi *.google.sc idsync.rlcdn.com *.google.com.gh *.google.co.th *.google.fr *.google.ht *.google.com *.porsche.cn *.google.co.jp *.google.nr *.google.ro *.google.com.py tr.snapchat.com *.google.com.af *.google.com.cu *.google.com.tj *.google.mn *.google.si *.google.im s1755874914.t.eloqua.com t.teads.tv *.google.ad *.google.bi *.google.com.mt *.google.be script.crazyegg.com *.google.com.br analytics.tiktok.com *.google.ba *.google.com.sg *.google.com.ly ignitify-insite.drivecentric.io pixel.mathtag.com *.google.hn td.doubleclick.net *.google.co.in *.google.la *.google.co.zm *.google.as *.google.pn c.bing.com *.google.ch *.google.ci *.google.gm dealership3d.com *.google.ge *.google.com.np *.clarity.ms *.google.com.kh *.google.ca *.google.com.gi *.google.mw image.moengage.com *.google.bj *.google.st p.teads.tv *.google.co.ao *.google.kg api.drivecentric.com *.google.ml edge.eu1.fullstory.com ignitify-tagmanager-scripts.drivecentric.io gubagoo.io *.google.sr *.porsche-preview.cn *.google.es c.clarity.ms *.google-analytics.com/ *.aws.porsche-preview.cloud/ *.facebook.com blob: *.google.com.tr cm.teads.tv *.google.com.jm *.googleapis.com/ *.google.al *.googletagmanager.com *.google.sk *.google.fm *.google.sn *.google.rs *.google.cn v.clarity.ms *.google.com.bo *.google.rw *.google.li r.turn.com *.google.co.uk *.google.pl snap.licdn.com *.google.lk *.google.com.uy *.google.sh *.google.bs *.google.co.ma static.klaviyo.com *.google.com.om img06.en25.com i.ytimg.com *.gubagoo.io *.google.com.fj *.google.cz *.google.lv *.google.com.sa *.google.mu *.google.td *.google.cv widgets.binotel.com *.google.co.kr *.google.co.mz *.google.cat rs.eu1.fullstory.com tr6.snapchat.com *.google.ki *.google.cf *.google.co.za https://userlike-cdn-operators.userlike.com/ *.google.ae *.google.co.zw *.google.com.mm *.google.at *.google.com.ar *.google.com.my *.google.gl *.google.bt *.google.tn *.google.com.pa *.google.co.ls fra1.qualtrics.com *.porsche.com *.google.ee *.google.ps ignitify-tagmanager.drivecentric.io s.adroll.com *.google.com.pk *.google.ne *.google.ru ignitify-insite-scripts.drivecentric.io scripts.foureyes.io *.google.com.sl *.doubleclick.net/ *.google.com.mx tags.bkrtx.com *.google.bg *.google.so *.google.se *.porsche-preview.com *.usercentrics.eu *.google.com.ua *.ggpht.com *.google.com.qa *.google.vu *.autouncle.de *.google.sm *.google.de *.google.com.co *.google.com.ni *.google.co.il *.google.com.vc *.google.com.ng *.google.hu *.google.ie stags.bluekai.com static.matterport.com *.google.tm files.superchat.de *.google.dz *.google.co.nz *.google.nl *.google.cl *.google.com.et unpkg.com static.app.carnow.com ad.doubleclick.net *.google.dj *.google.me *.google.com.cy *.google.cm *.google.com.bd *.google.mg *.google.com.eg *.google.nu *.google.com.au 'self' *.google.gr *.google.com.sv *.google.fi *.cloudfront.net *.fls.doubleclick.net

•Insecure HTTP source allowed in img-src

•Missing recommended values for img-src: self

style-srcHIGH

*.googletagmanager.com api.drivecentric.com assets.autouncle.com https://fonts.googleapis.com themes.static.app.carnow.com *.porsche-preview.cn fonts.bunny.net cdn.moengage.com app-cdn.moengage.com tags.srv.stackadapt.com 'self' *.porsche.cn *.porsche.com *.cloudfront.net 'unsafe-inline' *.porsche-preview.com

•Unsafe inline execution allowed in style-src

•Missing recommended values for style-src: sha384-, nonce-, sha512-, self, sha256-

font-srcHIGH

assets.autouncle.com *.porsche-preview.cn fonts.bunny.net https://userlike-cdn-umm.b-cdn.net/ https://fonts.gstatic.com 'self' *.porsche.cn data: *.cloudfront.net 'unsafe-inline' *.porsche-preview.com *.porsche.com

•Unsafe inline execution allowed in font-src

•Missing recommended values for font-src: self

upgrade-insecure-requestsLOW

block-all-mixed-contentLOW

frame-ancestorsLOW

'self'

•Missing recommended values for frame-ancestors: self, none

frame-srcLOW

tags.bluekai.com gain-vi.ca fledge.teads.tv widget.superchat.de https://porsche.com assets.autouncle.com adservice.google.com https://static.app.carnow.com dealership3d.s3.ap-southeast-2.amazonaws.com *.accelerate.dealer.com e.issuu.com porsche-shared.vercel.app d.adroll.com api.connectcdk.com o2.eyereturn.com rs.fullstory.com www.connectcdk.com assets.prod.analytics.dealer.com googleads.g.doubleclick.net static-tracking.klaviyo.com *.youtube.com bat.bing.com ut.foureyes.io tags.srv.stackadapt.com *.usercentrics.eu/ ct.pinterest.com videochat.mobilapp.io *.linkedin.com *.googleadservices.com connect.facebook.net cs.esm1.net edge.fullstory.com idsync.rlcdn.com https://sync.graph.bluecava.com *.porsche.cn *.google.com tr.snapchat.com https://creditbureauconnection.com conscheduling.tekioncloud.com www.cognitoforms.com t.teads.tv https://consumer.xtime.com/ script.crazyegg.com *.creditbureauconnection.com consumer.xtime.net.au analytics.tiktok.com ignitify-insite.drivecentric.io pixel.mathtag.com td.doubleclick.net c.bing.com dealership3d.com https://app.carnow.com/ *.clarity.ms p.teads.tv player.vimeo.com privacyportal.onetrust.com api.drivecentric.com edge.eu1.fullstory.com ignitify-tagmanager-scripts.drivecentric.io *.porsche-preview.cn c.clarity.ms cdn.moengage.com fca1.wpengine.com cm.teads.tv blob: *.facebook.com *.googletagmanager.com porsche-production.discover.chargetrip.com m.xtime.com v.clarity.ms r.turn.com snap.licdn.com static.klaviyo.com img06.en25.com https://pauc.syndication.kbb.com/ widgets.binotel.com rs.eu1.fullstory.com tr6.snapchat.com www.youtube-nocookie.com *.porsche.com ignitify-tagmanager.drivecentric.io s.adroll.com ignitify-insite-scripts.drivecentric.io scripts.foureyes.io *.doubleclick.net/ *.adform.net tags.bkrtx.com *.porsche-preview.com gaudinmotorcompany.bamboohr.com *.autouncle.de *.google.de stags.bluekai.com app-prod.flipacar.com static.matterport.com unpkg.com ad.doubleclick.net suite.dtdrs.dealertrack.com porsche-emails-v2.s3.eu-west-2.amazonaws.com *.hcaptcha.com/ 'self' files.superchat.de *.fls.doubleclick.net

•Missing recommended values for frame-src: self

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✗Referrer-PolicyMissing

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

How to add it:

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Referrer-Policy to "strict-origin-when-cross-origin"

✓Strict-Transport-SecurityPresent

max-age=15768000 ; includeSubDomains ; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✗X-Content-Type-OptionsMissing

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

How to add it:

nginx

add_header X-Content-Type-Options "nosniff" always;

apache

Header always set X-Content-Type-Options "nosniff"

cloudflare

Rules > Transform Rules > Managed Transforms > Enable "Add X-Content-Type-Options header"

✗X-Frame-OptionsMissing

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

How to add it:

nginx

add_header X-Frame-Options "DENY" always;

apache

Header always set X-Frame-Options "DENY"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"

✗X-XSS-ProtectionMissing

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

How to add it:

nginx

add_header X-XSS-Protection "0" always;

apache

Header always set X-XSS-Protection "0"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set X-XSS-Protection to "0"

5 recommended security headers are missing on porsche.lt.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about porsche.ltWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

porsche.lt

2 scans since 7/16/2025

Latest: 50/100

Total Scans

Latest Score

50/100

First Scan

7/16/2025

Last Scan

7/16/2025

Scan History

Date	Score	CSP	Headers	Issues	Action
Jul 16, 2025	D (50)	No	1/6	0	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: D (50/100) for porsche.lt

HTML

<a href="https://headertest.com/results/porsche.lt" title="Security headers grade for porsche.lt — HeaderTest">
  <img src="https://headertest.com/api/badge/porsche.lt" alt="HeaderTest security grade: D (50/100) for porsche.lt" />
</a>

Markdown

[![HeaderTest security grade: D (50/100) for porsche.lt](https://headertest.com/api/badge/porsche.lt)](https://headertest.com/results/porsche.lt)