← All Results
Domain History

serla.ee

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+
90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
default-src 'self' 'unsafe-eval'; script-src 'self' 'unsafe-eval' 'unsafe-inline'  *.aaui-879784980514.s3.us-east-2.amazonaws.com *.aauicdnva7.azureedge.net *.adform.net *.app.launchdarkly.com *.awaascicdprodva7.blob.core.windows.net *.d30ln29764hddd.cloudfront.net *.doubleclick.net *.euroland.com *.eurolandir.com *.googletagmanager.com *.jquery.com *.leaddesk.com *.linkedin.com *.omniture.com *.omtrdc.net *.services.adobe.com *.youtube.com http://maps.google.com/maps-api-v3/api/ http://maps.google.com/maps/api/ http://maps.googleapis.com/maps/api/ https://*.aptrinsic.com https://*.flockler.com https://adminconsole.adobe.com https://adobe.com https://adobe.io https://adobe.net https://adobeid-na1.services.adobe.com https://ajax.googleapis.com https://analytics-eu.clickdimensions.com https://api.emea01.idio.episerver.net https://app.powerbi.com https://assets.adobedtm.com https://assets.adobedtm.com https://assets2.adobe.com https://az416426.vo.msecnd.net/scripts/a/ai.0.js https://cdn.cookielaw.org https://cdn.jsdelivr.net/npm/ https://cdnjs.cloudflare.com/ajax/libs/popper.js/ https://cloudui-emea01.profilestore.episerver.net https://connect.facebook.net https://cookie-cdn.cookiepro.com https://d1igp3oop3iho5.cloudfront.net/v2/YTCU__QFgA3N4sqa5K5xQA-eu1/zaius-min.js https://d1igp3oop3iho5.cloudfront.net/v2/buA6R3hGThUwo2b3jMhdjQ-eu1/zaius-min.js https://dl.episerver.net https://fl-cdn.scdn1.secure.raxcdn.com https://geolocation.onetrust.com https://googleads.g.doubleclick.net https://js.monitor.azure.com/scripts/ https://kuula.co https://ld-webchat.s3.eu-north-1.amazonaws.com https://login.microsoftonline.com https://maps.googleapis.com https://maxcdn.bootstrapcdn.com/bootstrap/ https://research.innolink.fi https://s.emea01.idio.episerver.net/ https://snap.licdn.com https://sstats.adobe.com https://static.ads-twitter.com https://tpc.googlesyndication.com https://videolle.viewin360.co https://www.google.com https://www.google.com/recaptcha/ https://www.googleadservices.com https://www.gstatic.com/recaptcha/ https://youtube.com https://metsa-virtual-exhibition.netlify.app https://metsa-virtual-exhibition-two.netlify.app  https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/  https://*.hotjar.com/ https://cxppeur1rdrect01sa02cdn.blob.core.windows.net/; style-src 'self' 'unsafe-inline'  https://*.aptrinsic.com https://*.flockler.com https://app.powerbi.com https://cdn.jsdelivr.net/npm/ https://cloudui-emea01.profilestore.episerver.net https://dl.episerver.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com/bootstrap/ https://research.innolink.fi; img-src * data: ; connect-src 'self' ws:  *.aaui-879784980514.s3.us-east-2.amazonaws.com *.aauicdnva7.azureedge.net *.app.launchdarkly.com *.awaascicdprodva7.blob.core.windows.net *.d30ln29764hddd.cloudfront.net *.omniture.com *.omtrdc.net *.onetrust.com *.services.adobe.com https://*.analytics.google.com https://*.aptrinsic.com https://*.facebook.com https://*.flockler.app https://*.flockler.com https://*.doubleclick.net https://*.google-analytics.com https://*.google.cn https://*.google.co.uk https://*.google.com https://google.com https://*.google.cz https://*.google.de https://*.google.dk https://*.google.es https://*.google.et https://*.google.fi https://*.google.fr https://*.google.hu https://*.google.lt https://*.google.lv https://*.google.nl https://*.google.no https://*.google.pl https://*.google.sk https://*.google.sv https://*.googleadservices.com https://*.googletagmanager.com https://adminconsole.adobe.com https://adobe.com https://adobe.io https://adobe.net https://adobeid-na1.services.adobe.com https://assets.adobedtm.com https://assets2.adobe.com https://cdn.cookielaw.org https://cdn.linkedin.oribi.io https://cookie-cdn.cookiepro.com https://dc.services.visualstudio.com https://dpm.demdex.net https://maps.googleapis.com https://publish.ne.cision.com https://px.ads.linkedin.com https://research.innolink.fi https://sstats.adobe.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/ https://public-eur.mkt.dynamics.com/ https://assets-eur.mkt.dynamics.com/ https://*.hotjar.io wss://*.hotjar.com  https://mobile.events.data.microsoft.com/ https://c.ba.contentsquare.net; font-src 'self' data:  https://*.cloudfront.net https://*.flockler.com https://fonts.googleapis.com https://fonts.gstatic.com https://assets-eur.mkt.dynamics.com; media-src 'self' ; frame-src 'self' *.adform.net *.calculationtools.com *.dreambroker.com *.euroland.com *.eurolandir.com *.doubleclick.net *.jquery.com *.leaddesk.com *.op-koti.fi *.videosync.fi *.vimeo.com *.youtube.com https://*.cloudflarestream.com https://*.facebook.com https://*.flockler.com https://analytics-eu.clickdimensions.com https://app.powerbi.com https://cdn.videosync.fi https://cloudui-emea01.profilestore.episerver.net https://ctne.tecviz.net https://dreambroker.com https://events.icareus.com https://interactive.brightgroup.com https://kuula.co https://manager.EMEA01.idio.episerver.net https://metsaliitto.demdex.net https://op-koti.fi https://open.spotify.com/embed/ https://research.innolink.fi https://statistics-dashboard.azurewebsites.net https://storage.net-fs.com https://videolle.viewin360.co https://vimeo.com https://www.google.com https://youtu.be https://youtube.com https://metsa-virtual-exhibition.netlify.app https://dho665cc9sh82.cloudfront.net https://metsa-virtual-exhibition-two.netlify.app https://samgosembedprod.azurewebsites.net/en/embeds/mw-co2 https://vara-services.com/ *.googletagmanager.com;  report-uri https://www.metsagroup.com/api/reporting/;  report-to csp-endpoint;
Directive Analysis
default-srcHIGH
'self' 'unsafe-eval'
•Unsafe eval() execution allowed in default-src
•Missing recommended values for default-src: self
script-srcHIGH
https://adobeid-na1.services.adobe.com *.omtrdc.net https://*.flockler.com https://assets.adobedtm.com *.services.adobe.com https://cloudui-emea01.profilestore.episerver.net *.leaddesk.com https://login.microsoftonline.com *.awaascicdprodva7.blob.core.windows.net https://static.ads-twitter.com https://api.emea01.idio.episerver.net https://adobe.com https://*.aptrinsic.com https://adobe.io https://ajax.googleapis.com https://fl-cdn.scdn1.secure.raxcdn.com https://s.emea01.idio.episerver.net/ https://cdn.cookielaw.org https://cdn.jsdelivr.net/npm/ 'unsafe-eval' http://maps.googleapis.com/maps/api/ https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/ 'unsafe-inline' *.eurolandir.com https://kuula.co *.linkedin.com https://googleads.g.doubleclick.net https://js.monitor.azure.com/scripts/ https://analytics-eu.clickdimensions.com https://ld-webchat.s3.eu-north-1.amazonaws.com https://sstats.adobe.com 'self' *.doubleclick.net *.app.launchdarkly.com https://research.innolink.fi http://maps.google.com/maps-api-v3/api/ https://www.googleadservices.com *.youtube.com https://adobe.net https://app.powerbi.com https://assets2.adobe.com https://cookie-cdn.cookiepro.com https://youtube.com https://www.google.com https://metsa-virtual-exhibition.netlify.app https://az416426.vo.msecnd.net/scripts/a/ai.0.js *.adform.net https://adminconsole.adobe.com https://www.google.com/recaptcha/ *.jquery.com https://dl.episerver.net https://geolocation.onetrust.com *.aauicdnva7.azureedge.net *.omniture.com *.googletagmanager.com https://www.gstatic.com/recaptcha/ https://metsa-virtual-exhibition-two.netlify.app http://maps.google.com/maps/api/ https://cdnjs.cloudflare.com/ajax/libs/popper.js/ *.aaui-879784980514.s3.us-east-2.amazonaws.com https://videolle.viewin360.co https://snap.licdn.com https://d1igp3oop3iho5.cloudfront.net/v2/buA6R3hGThUwo2b3jMhdjQ-eu1/zaius-min.js https://cxppeur1rdrect01sa02cdn.blob.core.windows.net/ https://d1igp3oop3iho5.cloudfront.net/v2/YTCU__QFgA3N4sqa5K5xQA-eu1/zaius-min.js https://*.hotjar.com/ https://maps.googleapis.com https://tpc.googlesyndication.com https://connect.facebook.net https://maxcdn.bootstrapcdn.com/bootstrap/ *.d30ln29764hddd.cloudfront.net *.euroland.com
•Unsafe eval() execution allowed in script-src
•Insecure HTTP source allowed in script-src
•Unsafe inline execution allowed in script-src
•Insecure HTTP source allowed in script-src
•Insecure HTTP source allowed in script-src
•Missing recommended values for script-src: sha256-, sha512-, nonce-, self, sha384-
•No nonces or hashes used for script-src
style-srcHIGH
'unsafe-inline' https://*.flockler.com https://cloudui-emea01.profilestore.episerver.net https://app.powerbi.com https://maxcdn.bootstrapcdn.com/bootstrap/ https://fonts.googleapis.com 'self' https://*.aptrinsic.com https://research.innolink.fi https://cdn.jsdelivr.net/npm/ https://dl.episerver.net
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha256-, sha512-, nonce-, self, sha384-
img-srcHIGH
data: *
•Overly permissive wildcard (*) in img-src
•Missing recommended values for img-src: self
connect-srcLOW
https://adobeid-na1.services.adobe.com *.omtrdc.net https://*.google.no https://*.flockler.com https://assets.adobedtm.com *.services.adobe.com https://*.google.hu https://*.googleadservices.com *.awaascicdprodva7.blob.core.windows.net https://*.google.pl *.onetrust.com https://adobe.com https://*.aptrinsic.com https://*.analytics.google.com https://*.google.cz https://adobe.io https://*.hotjar.io https://cdn.cookielaw.org https://mobile.events.data.microsoft.com/ https://*.google.et https://cdn.linkedin.oribi.io https://*.google.cn https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/ https://publish.ne.cision.com https://sstats.adobe.com https://google.com 'self' https://px.ads.linkedin.com ws: *.app.launchdarkly.com https://*.google.co.uk https://*.google.nl https://*.google-analytics.com https://*.google.dk https://research.innolink.fi https://*.google.sv https://adobe.net https://*.google.lv https://c.ba.contentsquare.net https://dpm.demdex.net https://assets2.adobe.com https://*.google.es https://cookie-cdn.cookiepro.com https://dc.services.visualstudio.com https://*.google.de https://*.google.sk https://adminconsole.adobe.com https://*.flockler.app *.aauicdnva7.azureedge.net *.omniture.com https://*.doubleclick.net https://*.google.fi wss://*.hotjar.com https://*.facebook.com *.aaui-879784980514.s3.us-east-2.amazonaws.com https://assets-eur.mkt.dynamics.com/ https://*.google.fr https://*.googletagmanager.com https://maps.googleapis.com https://*.google.lt https://public-eur.mkt.dynamics.com/ *.d30ln29764hddd.cloudfront.net https://*.google.com
•Missing recommended values for connect-src: self
font-srcLOW
https://*.flockler.com data: https://*.cloudfront.net https://fonts.googleapis.com 'self' https://assets-eur.mkt.dynamics.com https://fonts.gstatic.com
•Missing recommended values for font-src: self
media-srcLOW
'self'
•Missing recommended values for media-src: self
frame-srcLOW
https://*.flockler.com https://cloudui-emea01.profilestore.episerver.net https://open.spotify.com/embed/ *.leaddesk.com https://vara-services.com/ https://events.icareus.com https://statistics-dashboard.azurewebsites.net *.eurolandir.com https://kuula.co https://cdn.videosync.fi https://analytics-eu.clickdimensions.com 'self' *.doubleclick.net https://*.cloudflarestream.com https://op-koti.fi *.vimeo.com https://research.innolink.fi https://manager.EMEA01.idio.episerver.net https://samgosembedprod.azurewebsites.net/en/embeds/mw-co2 *.youtube.com https://app.powerbi.com *.dreambroker.com https://metsaliitto.demdex.net https://storage.net-fs.com https://dreambroker.com https://www.google.com https://metsa-virtual-exhibition.netlify.app *.videosync.fi *.adform.net https://vimeo.com *.jquery.com https://dho665cc9sh82.cloudfront.net *.calculationtools.com *.googletagmanager.com https://ctne.tecviz.net https://interactive.brightgroup.com https://*.facebook.com https://metsa-virtual-exhibition-two.netlify.app https://videolle.viewin360.co *.op-koti.fi https://youtu.be https://youtube.com *.euroland.com
•Missing recommended values for frame-src: self
report-uriLOW
https://www.metsagroup.com/api/reporting/
report-toLOW
csp-endpoint
Content Security PolicyHIGH
script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' 'nonce-4a8a5808-6770-438f-9339-27248966bc4e'  *.aaui-879784980514.s3.us-east-2.amazonaws.com *.aauicdnva7.azureedge.net *.adform.net *.app.launchdarkly.com *.awaascicdprodva7.blob.core.windows.net *.d30ln29764hddd.cloudfront.net *.doubleclick.net *.euroland.com *.eurolandir.com *.googletagmanager.com *.jquery.com *.leaddesk.com *.linkedin.com *.omniture.com *.omtrdc.net *.services.adobe.com *.youtube.com http://maps.google.com/maps-api-v3/api/ http://maps.google.com/maps/api/ http://maps.googleapis.com/maps/api/ https://*.aptrinsic.com https://*.flockler.com https://adminconsole.adobe.com https://adobe.com https://adobe.io https://adobe.net https://adobeid-na1.services.adobe.com https://ajax.googleapis.com https://analytics-eu.clickdimensions.com https://api.emea01.idio.episerver.net https://app.powerbi.com https://assets.adobedtm.com https://assets.adobedtm.com https://assets2.adobe.com https://az416426.vo.msecnd.net/scripts/a/ai.0.js https://cdn.cookielaw.org https://cdn.jsdelivr.net/npm/ https://cdnjs.cloudflare.com/ajax/libs/popper.js/ https://cloudui-emea01.profilestore.episerver.net https://connect.facebook.net https://cookie-cdn.cookiepro.com https://d1igp3oop3iho5.cloudfront.net/v2/YTCU__QFgA3N4sqa5K5xQA-eu1/zaius-min.js https://d1igp3oop3iho5.cloudfront.net/v2/buA6R3hGThUwo2b3jMhdjQ-eu1/zaius-min.js https://dl.episerver.net https://fl-cdn.scdn1.secure.raxcdn.com https://geolocation.onetrust.com https://googleads.g.doubleclick.net https://js.monitor.azure.com/scripts/ https://kuula.co https://ld-webchat.s3.eu-north-1.amazonaws.com https://login.microsoftonline.com https://maps.googleapis.com https://maxcdn.bootstrapcdn.com/bootstrap/ https://research.innolink.fi https://s.emea01.idio.episerver.net/ https://snap.licdn.com https://sstats.adobe.com https://static.ads-twitter.com https://tpc.googlesyndication.com https://videolle.viewin360.co https://www.google.com https://www.google.com/recaptcha/ https://www.googleadservices.com https://www.gstatic.com/recaptcha/ https://youtube.com https://metsa-virtual-exhibition.netlify.app https://metsa-virtual-exhibition-two.netlify.app  https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/  https://*.hotjar.com/ https://cxppeur1rdrect01sa02cdn.blob.core.windows.net/;  report-uri https://www.metsagroup.com/api/reporting/;  report-to csp-endpoint;
Directive Analysis
script-srcHIGH
https://adobeid-na1.services.adobe.com *.omtrdc.net https://*.flockler.com https://assets.adobedtm.com *.services.adobe.com https://cloudui-emea01.profilestore.episerver.net *.leaddesk.com https://login.microsoftonline.com 'strict-dynamic' *.awaascicdprodva7.blob.core.windows.net https://static.ads-twitter.com https://api.emea01.idio.episerver.net https://adobe.com https://*.aptrinsic.com https://adobe.io https://ajax.googleapis.com https://fl-cdn.scdn1.secure.raxcdn.com https://s.emea01.idio.episerver.net/ https://cdn.cookielaw.org https://cdn.jsdelivr.net/npm/ 'unsafe-eval' http://maps.googleapis.com/maps/api/ https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/ 'unsafe-inline' 'nonce-4a8a5808-6770-438f-9339-27248966bc4e' *.eurolandir.com https://kuula.co *.linkedin.com https://googleads.g.doubleclick.net https://js.monitor.azure.com/scripts/ https://analytics-eu.clickdimensions.com https://ld-webchat.s3.eu-north-1.amazonaws.com https://sstats.adobe.com 'self' *.doubleclick.net *.app.launchdarkly.com https://research.innolink.fi http://maps.google.com/maps-api-v3/api/ https://www.googleadservices.com *.youtube.com https://adobe.net https://app.powerbi.com https://assets2.adobe.com https://cookie-cdn.cookiepro.com https://youtube.com https://www.google.com https://metsa-virtual-exhibition.netlify.app https://az416426.vo.msecnd.net/scripts/a/ai.0.js *.adform.net https://adminconsole.adobe.com https://www.google.com/recaptcha/ *.jquery.com https://dl.episerver.net https://geolocation.onetrust.com *.aauicdnva7.azureedge.net *.omniture.com *.googletagmanager.com https://www.gstatic.com/recaptcha/ https://metsa-virtual-exhibition-two.netlify.app http://maps.google.com/maps/api/ https://cdnjs.cloudflare.com/ajax/libs/popper.js/ *.aaui-879784980514.s3.us-east-2.amazonaws.com https://videolle.viewin360.co https://snap.licdn.com https://d1igp3oop3iho5.cloudfront.net/v2/buA6R3hGThUwo2b3jMhdjQ-eu1/zaius-min.js https://cxppeur1rdrect01sa02cdn.blob.core.windows.net/ https://d1igp3oop3iho5.cloudfront.net/v2/YTCU__QFgA3N4sqa5K5xQA-eu1/zaius-min.js https://*.hotjar.com/ https://maps.googleapis.com https://tpc.googlesyndication.com https://connect.facebook.net https://maxcdn.bootstrapcdn.com/bootstrap/ *.d30ln29764hddd.cloudfront.net *.euroland.com
•Unsafe eval() execution allowed in script-src
•Insecure HTTP source allowed in script-src
•Unsafe inline execution allowed in script-src
•Insecure HTTP source allowed in script-src
•Insecure HTTP source allowed in script-src
•Missing recommended values for script-src: sha256-, sha512-, nonce-, self, sha384-
•No nonces or hashes used for script-src
report-uriLOW
https://www.metsagroup.com/api/reporting/
report-toLOW
csp-endpoint

Security Headers

✓Permissions-PolicyPresent

accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✗X-XSS-ProtectionMissing

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

How to add it:

nginx
add_header X-XSS-Protection "0" always;
apache
Header always set X-XSS-Protection "0"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-XSS-Protection to "0"

1 recommended security header is missing on serla.ee.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about serla.eeWeak headers often come with other exposure — check the full picture.

serla.ee

3 scans since 7/19/2025

A+

Latest: 90/100

Total Scans

3

Latest Score

90/100

First Scan

7/19/2025

Last Scan

7/19/2025

Score Trend

Security score progression over 2 scans

Scan History

DateScoreCSPHeadersIssuesAction
Jul 19, 2025
A+ (90)
No
5/60View →
Jul 19, 2025
A+ (90)
No
5/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for serla.ee
HTML
<a href="https://headertest.com/results/serla.ee" title="Security headers grade for serla.ee — HeaderTest">
  <img src="https://headertest.com/api/badge/serla.ee" alt="HeaderTest security grade: A+ (90/100) for serla.ee" />
</a>
Markdown
[![HeaderTest security grade: A+ (90/100) for serla.ee](https://headertest.com/api/badge/serla.ee)](https://headertest.com/results/serla.ee)