← All Results
Domain History

secsoft.ee

Grade A+ · 100/100 · 6/6 security headers present

Security Score

A+
100/ 100

Security Headers

6/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.vimeo.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' connect.facebook.net www.facebook.com https://connect.facebook.net/en_US/fbevents.js https://www.google.com/recaptcha/api.js www.gstatic.com www.google.com https://www.gstatic.com/recaptcha/ www.google.com/recaptcha/ https://snap.licdn.com/li.lms-analytics/insight.min.js https://cdnjs.cloudflare.com/ajax/libs/ekko-lightbox/5.3.0/ekko-lightbox.min.js https://www.googletagmanager.com https://snap.licdn.com/li.lms-analytics/insight.old.min.js https://snap.licdn.com/li.lms-analytics/insight.beta.min.js *.vimeo.com *.vimeocdn.com *.newrelic.com *.nr-data.net www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: *.vimeocdn.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://www.facebook.com https://maps.gstatic.com www.googletagmanager.com *.google.com *.doubleclick.net *.googleadservices.net *.linkedin.com *.google-analytics.com *.analytics.google.com *.google.ee s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com; connect-src 'self' https://www.facebook.com/tr/ *.google-analytics.com *.analytics.google.com *.google.ee https://cdn.linkedin.oribi.io/partner/1173730/domain/cybers.eu/token https://cdn.linkedin.oribi.io/report/error https://px.ads.linkedin.com https://www.google.com *.vimeo.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src * ; frame-src 'self' www.google.com/recaptcha/ https://www.google.com https://w.soundcloud.com *.vimeo.com *.vimeocdn.com https://www.vimeo.com/ https://vimeo.com/ https://www.youtube.com/ *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.googletagmanager.com; child-src 'self' *.vimeo.com *.vimeocdn.com www.googletagmanager.com; frame-ancestors 'self' ; upgrade-insecure-requests; report-uri https://neverhack.ee?gdsih-csp-report;
Directive Analysis
default-srcHIGH
*.vimeo.com 'unsafe-inline' 'unsafe-eval' 'self' data:
•Unsafe inline execution allowed in default-src
•Unsafe eval() execution allowed in default-src
•Missing recommended values for default-src: self
script-srcHIGH
adservice.google.com.tr maps.google.com adservice.google.com.mm adservice.google.co.th adservice.google.com.uy adservice.google.dz adservice.google.bs adservice.google.com.ng adservice.google.com.om *.vimeo.com adservice.google.com.vn adservice.google.com.pa https://cdnjs.cloudflare.com/ajax/libs/ekko-lightbox/5.3.0/ekko-lightbox.min.js adservice.google.rs adservice.google.com.np adservice.google.lu adservice.google.ge adservice.google.com.bh adservice.google.co.il adservice.google.com.kw adservice.google.ru ssl.google-analytics.com adservice.google.com.my maps.googleapis.com www.facebook.com adservice.google.com.jm adservice.google.co.jp www.googletagmanager.com adservice.google.cz adservice.google.so www.google-analytics.com stats.g.doubleclick.net adservice.google.com.et adservice.google.iq tagmanager.google.com adservice.google.lt ajax.googleapis.com adservice.google.co.bw adservice.google.com.eg adservice.google.ro adservice.google.lv adservice.google.sr adservice.google.tt adservice.google.md adservice.google.co.tz adservice.google.com.bn https://www.googletagmanager.com adservice.google.mu adservice.google.kz adservice.google.se https://snap.licdn.com/li.lms-analytics/insight.min.js adservice.google.com.cy https://www.google.com/recaptcha/api.js adservice.google.co.uz adservice.google.hn adservice.google.com.br adservice.google.cl adservice.google.com.kh adservice.google.lk adservice.google.pt adservice.google.jo adservice.google.ae adservice.google.mk *.googleadservices.com adservice.google.com.mx adservice.google.pl adservice.google.ee adservice.google.sk www.googletagservices.com adservice.google.de adservice.google.si https://www.gstatic.com/recaptcha/ adservice.google.com.co adservice.google.com.pk adservice.google.ca adservice.google.com.bo adservice.google.com.sa google-analytics.com adservice.google.at adservice.google.nl adservice.google.bg *.nr-data.net adservice.google.co.nz adservice.google.be adservice.google.com.bd adservice.google.co.in adservice.google.co.ke adservice.google.com.gh adservice.google.co.za adservice.google.it adservice.google.al adservice.google.no *.newrelic.com adservice.google.com.ua https://connect.facebook.net/en_US/fbevents.js adservice.google.ie connect.facebook.net adservice.google.com.fj 'self' adservice.google.dk adservice.google.im https://snap.licdn.com/li.lms-analytics/insight.beta.min.js adservice.google.hr adservice.google.ch adservice.google.com.hk adservice.google.com.ph adservice.google.com.ni adservice.google.com.sv adservice.google.co.ve adservice.google.com.ec adservice.google.co.id adservice.google.co.kr translate.google.com translate.googleapis.com *.googlesyndication.com adservice.google.co.zw 'unsafe-eval' adservice.google.com.ai adservice.google.fr adservice.google.li adservice.google.co.zm adservice.google.com.au adservice.google.gr adservice.google.com.pr adservice.google.co.uk www.gstatic.com adservice.google.co.mz https://snap.licdn.com/li.lms-analytics/insight.old.min.js adservice.google.com.py adservice.google.com.sg adservice.google.com adservice.google.ci www.google.com adservice.google.com.gt googletagmanager.com googleads.g.doubleclick.net adservice.google.com.mt adservice.google.tn adservice.google.gy *.vimeocdn.com adservice.google.com.qa adservice.google.hu adservice.google.tl adservice.google.com.tw www.google.com/recaptcha/ adservice.google.com.ar adservice.google.com.lb 'unsafe-inline' adservice.google.com.pe adservice.google.es adservice.google.fi adservice.google.co.cr adservice.google.com.gi adservice.google.is
•Unsafe eval() execution allowed in script-src
•Unsafe inline execution allowed in script-src
•Missing recommended values for script-src: sha256-, self, sha512-, nonce-, sha384-
•No nonces or hashes used for script-src
style-srcHIGH
*.vimeocdn.com fonts.googleapis.com maps.google.com translate.googleapis.com tagmanager.google.com 'unsafe-inline' maps.googleapis.com 'self' www.googletagmanager.com data:
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, self, sha512-, nonce-, sha384-
img-srcLOW
secure.gravatar.com maps.google.com translate.google.com translate.googleapis.com *.googlesyndication.com *.googleadservices.net *.linkedin.com *.google-analytics.com https://maps.gstatic.com *.doubleclick.net www.gravatar.com ts.w.org 'self' *.googleapis.com www.gstatic.com *.ggpht.com ssl.google-analytics.com google-analytics.com www.google.com maps.gstatic.com *.google.ee www.googletagmanager.com data: www.google-analytics.com https://www.facebook.com stats.g.doubleclick.net *.analytics.google.com s.w.org ps.w.org *.google.com blob:
•Missing recommended values for img-src: self
connect-srcLOW
maps.google.com translate.googleapis.com *.googlesyndication.com ampcid.google.com https://cdn.linkedin.oribi.io/report/error analytics.google.com *.google-analytics.com https://www.facebook.com/tr/ *.vimeo.com 'self' maps.googleapis.com about: *.google.ee https://cdn.linkedin.oribi.io/partner/1173730/domain/cybers.eu/token googleads.g.doubleclick.net www.google-analytics.com stats.g.doubleclick.net https://www.google.com https://px.ads.linkedin.com *.analytics.google.com www.googletagmanager.com
•Missing recommended values for connect-src: self
font-srcLOW
fonts.gstatic.com fonts.googleapis.com data: 'self'
•Missing recommended values for font-src: self
object-srcLOW
'self'
•Missing recommended values for object-src: none
media-srcHIGH
*
•Overly permissive wildcard (*) in media-src
•Missing recommended values for media-src: self
frame-srcLOW
*.vimeocdn.com maps.google.com https://www.google.com *.vimeo.com www.google.com/recaptcha/ *.googlesyndication.com maps.googleapis.com googleads.g.doubleclick.net www.googletagmanager.com https://www.vimeo.com/ https://w.soundcloud.com https://www.youtube.com/ https://vimeo.com/ 'self'
•Missing recommended values for frame-src: self
child-srcLOW
www.googletagmanager.com *.vimeo.com *.vimeocdn.com 'self'
•Unknown directive: child-src
frame-ancestorsLOW
'self'
•Missing recommended values for frame-ancestors: self, none
upgrade-insecure-requestsLOW
report-uriLOW
https://neverhack.ee?gdsih-csp-report

Security Headers

✓Permissions-PolicyPresent

fullscreen=(), geolocation=(), midi=(), payment=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=15552000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

0

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about secsoft.eeWeak headers often come with other exposure — check the full picture.

secsoft.ee

3 scans since 7/19/2025

A+

Latest: 100/100

Total Scans

3

Latest Score

100/100

First Scan

7/19/2025

Last Scan

7/19/2025

Score Trend

Security score progression over 2 scans

Scan History

DateScoreCSPHeadersIssuesAction
Jul 19, 2025
A+ (100)
No
6/60View →
Jul 19, 2025
A+ (100)
No
6/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (100/100) for secsoft.ee
HTML
<a href="https://headertest.com/results/secsoft.ee" title="Security headers grade for secsoft.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/secsoft.ee" alt="HeaderTest security grade: A+ (100/100) for secsoft.ee" />
</a>
Markdown
[![HeaderTest security grade: A+ (100/100) for secsoft.ee](https://headertest.com/api/badge/secsoft.ee)](https://headertest.com/results/secsoft.ee)