← All Results
Domain History

sgs.lv

Grade A+ · 90/100 · 5/6 security headers present

Security Score

A+
90/ 100

Security Headers

5/ 6

CSP Violations

NoViolations

Issues Found

0Issues

Recommendations

0Available

CSP Analysis

Content Security PolicyHIGH
default-src 'self' 'unsafe-inline' *.coveo.com *.google-analytics.com *.google.com *.googletagmanager.com *.imgix.net *.leadoo.com *.sgs.com *.sgsgroup.com.cn cdn.cookielaw.org cdn.jsdelivr.net f7132108c1tst-store.occa.ocs.oraclecloud.com1 fonts.googleapis.com jobpal-sm.s3.amazonaws.com pagead2.googlesyndication.com;
			font-src 'self' data: *.googleapis.com *.gstatic.com *.hotjar.com *.hotjar.io *.smooch.io jobpal-sm.s3.amazonaws.com res.leadoo.com;
			script-src 'self' 'unsafe-inline' 'unsafe-eval' *.baidu.com *.beyondwords.io *.cloudfront.net *.cookielaw.org *.coveo.com *.doubleclick.net *.eloqua.com *.en25.com *.facebook.com *.google-analytics.com *.google.com *.googleadservices.com *.googleanalytics.com *.googleoptimize.com *.googletagmanager.com *.gstatic.com *.hotjar.com *.hotjar.io *.leadoo.com *.mapbox.com *.sgsmall.com.cn *.sgsonline.com.cn *.smooch.io *.storerocket.io *.youtube.com cdn.jsdelivr.net https://challenges.cloudflare.com https://connect.facebook.net https://content.linkedin.com https://maps.googleapis.com https://platform.linkedin.com https://snap.licdn.com https://static-exp1.licdn.com https://storemapper-herokuapp-com.global.ssl.fastly.net https://unpkg.com https://www.recaptcha.net https://www.storemapper.co jobpal-sm.s3.amazonaws.com pagead2.googlesyndication.com s.go-mpulse.net;
			style-src 'self' 'unsafe-inline' *.google.com https://fonts.googleapis.com jobpal-sm.s3.amazonaws.com *.leadoo.com *.sgs-next.com *.coveo.com https://maps.googleapis.com *.cloudfront.net;
			frame-src 'self' tools.eurolandir.com *.google.com youtu.be *.sgs.com *.youtube.com *.youtube-nocookie.com *.hotjar.com *.sgs.com *.sgs.pl *.sgsgroup.com.cn *.hotjar.com *.hotjar.io *.smooch.io *.doubleclick.net *.linkedin.com *.facebook.com connect.facebook.net *.leadoo.com https://www.recaptcha.net *.doubleclick.net https://*.acast.com *.spotify.com https://view.genial.ly *.baidu.com https://challenges.cloudflare.com *.flippingbook.com *.sgsonline.com.cn *.genially.com;
			child-src 'self' *.youtube-nocookie.com *.youtube.com v.qq.com *.google.com *.sgs.com *.facebook.com connect.facebook.net;
			frame-ancestors 'self' *.googletagmanager.com *.sgs.com *.sgs.pl *.flippingbook.com;
			connect-src 'self' *.sgsgroup.com.cn *.sgs.com *.sgs-next.com f7132108c1tst-store.occa.ocs.oraclecloud.com cdn.cookielaw.org *.leadoo.com anl.leadoo.com pagead2.googlesyndication.com *.google-analytics.com *.google.com *.doubleclick.net privacyportal-de.onetrust.com *.go-mpulse.net jobpal-sm.s3.amazonaws.com *.hotjar.com *.hotjar.io wss://ws.hotjar.com *.smooch.io *.googletagmanager.com *.linkedin.com *.licdn.com *.facebook.com connect.facebook.net *.akstat.io https://cdn.linkedin.oribi.io https://geolocation.onetrust.com *.coveo.com https://*.beyondwords.io https://maps.googleapis.com *.cloudfront.net *.flippingbook.com *.sgsonline.com.cn storerocket.io *.mapbox.com;
			img-src 'self' data: *.sgsgroup.com.cn *.sgs.com *.sgs-next.com *.imgix.net *.leadoo.com *.eloqua.com i.ytimg.com cdn.cookielaw.org *.cdninstagram.com *.hotjar.com *.hotjar.io *.doubleclick.net *.smooch.io *.gstatic.com *.linkedin.com *.licdn.com p.adsymptotic.com *.facebook.com *.facebook.net *.fbcdn.net *.google.com *.googlesyndication.com *.googletagmanager.com *.google-analytics.com *.baidu.com *.cpsc.gov *.productsafety.gov.au ec.europa.eu https://maps.googleapis.com *.cloudfront.net *.sgsonline.com.cn *.google.ca *.google.de *.google.pl *.google.co.in *.google.es *.google.nl *.google.be *.google.com.hk *.google.com.au *.google.com.br *.google.co.za *.google.ae *.google.com.co *.google.com.pe *.google.com.sg *.google.ch *.google.com.tr *.google.co.id *.google.pt *.google.hu *.google.ro *.google.co.uk *.google.co.th *.google.fr *.google.com.tw *.google.com.my *.google.com.mx *.google.co.nz *.storerocket.io;
			worker-src 'self' https: blob:;
			media-src 'self' blob: media.licdn.com *.cloudfront.net;
			form-action 'self' *.facebook.com connect.facebook.net;
Directive Analysis
default-srcHIGH
*.google-analytics.com *.googletagmanager.com *.imgix.net cdn.cookielaw.org *.leadoo.com *.coveo.com *.sgs.com *.sgsgroup.com.cn 'self' 'unsafe-inline' f7132108c1tst-store.occa.ocs.oraclecloud.com1 jobpal-sm.s3.amazonaws.com cdn.jsdelivr.net pagead2.googlesyndication.com fonts.googleapis.com *.google.com
•Unsafe inline execution allowed in default-src
•Missing recommended values for default-src: self
font-srcLOW
*.hotjar.com *.smooch.io data: *.hotjar.io *.googleapis.com 'self' *.gstatic.com jobpal-sm.s3.amazonaws.com res.leadoo.com
•Missing recommended values for font-src: self
script-srcHIGH
*.googletagmanager.com https://www.storemapper.co *.leadoo.com *.storerocket.io https://static-exp1.licdn.com *.sgsmall.com.cn *.hotjar.io *.googleadservices.com *.cookielaw.org cdn.jsdelivr.net https://snap.licdn.com *.hotjar.com *.mapbox.com *.doubleclick.net *.beyondwords.io *.baidu.com 'unsafe-inline' https://unpkg.com jobpal-sm.s3.amazonaws.com *.googleanalytics.com https://maps.googleapis.com *.google.com *.sgsonline.com.cn https://platform.linkedin.com *.smooch.io https://storemapper-herokuapp-com.global.ssl.fastly.net 'self' *.eloqua.com *.google-analytics.com *.cloudfront.net *.coveo.com *.googleoptimize.com 'unsafe-eval' *.facebook.com https://connect.facebook.net *.en25.com s.go-mpulse.net *.gstatic.com https://content.linkedin.com https://www.recaptcha.net pagead2.googlesyndication.com *.youtube.com https://challenges.cloudflare.com
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: sha512-, self, sha384-, sha256-, nonce-
•No nonces or hashes used for script-src
style-srcHIGH
*.leadoo.com https://fonts.googleapis.com *.coveo.com *.cloudfront.net 'self' 'unsafe-inline' jobpal-sm.s3.amazonaws.com *.sgs-next.com https://maps.googleapis.com *.google.com
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: sha512-, self, sha384-, sha256-, nonce-
frame-srcLOW
*.leadoo.com *.hotjar.io https://view.genial.ly youtu.be *.genially.com *.spotify.com *.hotjar.com *.doubleclick.net *.youtube-nocookie.com *.baidu.com *.linkedin.com *.google.com *.sgsonline.com.cn *.smooch.io *.sgs.com *.sgsgroup.com.cn 'self' https://*.acast.com tools.eurolandir.com *.flippingbook.com *.sgs.pl *.facebook.com *.youtube.com https://www.recaptcha.net connect.facebook.net https://challenges.cloudflare.com
•Missing recommended values for frame-src: self
child-srcLOW
connect.facebook.net v.qq.com *.youtube-nocookie.com *.sgs.com *.facebook.com 'self' *.youtube.com *.google.com
•Unknown directive: child-src
frame-ancestorsLOW
*.googletagmanager.com *.sgs.pl *.sgs.com 'self' *.flippingbook.com
•Missing recommended values for frame-ancestors: none, self
connect-srcLOW
*.googletagmanager.com *.leadoo.com *.hotjar.io *.go-mpulse.net https://geolocation.onetrust.com storerocket.io cdn.cookielaw.org *.hotjar.com *.doubleclick.net *.mapbox.com https://cdn.linkedin.oribi.io wss://ws.hotjar.com privacyportal-de.onetrust.com https://*.beyondwords.io jobpal-sm.s3.amazonaws.com *.linkedin.com https://maps.googleapis.com *.google.com *.sgsonline.com.cn *.smooch.io f7132108c1tst-store.occa.ocs.oraclecloud.com *.sgs.com *.sgsgroup.com.cn 'self' *.sgs-next.com *.flippingbook.com *.google-analytics.com anl.leadoo.com *.cloudfront.net *.akstat.io *.coveo.com *.facebook.com pagead2.googlesyndication.com *.licdn.com connect.facebook.net
•Missing recommended values for connect-src: self
img-srcLOW
*.googletagmanager.com *.leadoo.com *.storerocket.io *.hotjar.io *.google.com.co *.google.com.mx *.google.co.in *.google.es *.google.com.tr *.google.co.id *.google.ro cdn.cookielaw.org *.hotjar.com *.doubleclick.net *.google.com.my *.google.com.sg *.google.pl *.baidu.com *.cpsc.gov *.facebook.net *.linkedin.com https://maps.googleapis.com *.google.com *.sgsonline.com.cn *.google.ch *.smooch.io *.google.com.hk *.sgs.com *.sgsgroup.com.cn 'self' *.google.co.th *.google.pt *.google.ae *.google.hu *.cdninstagram.com *.google.co.uk *.google.com.au *.google.nl *.sgs-next.com *.fbcdn.net *.google.ca *.eloqua.com *.google.de *.googlesyndication.com *.google.co.za *.google-analytics.com *.imgix.net *.cloudfront.net *.productsafety.gov.au data: *.google.com.tw *.facebook.com *.google.co.nz *.google.be i.ytimg.com *.gstatic.com ec.europa.eu *.google.fr p.adsymptotic.com *.licdn.com *.google.com.pe *.google.com.br
•Missing recommended values for img-src: self
worker-srcLOW
blob: 'self' https:
•Missing recommended values for worker-src: none, self
media-srcLOW
blob: 'self' *.cloudfront.net media.licdn.com
•Missing recommended values for media-src: self
form-actionLOW
connect.facebook.net *.facebook.com 'self'
•Missing recommended values for form-action: self

Security Headers

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value
✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=86400

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

1 recommended security header is missing on sgs.lv.

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about sgs.lvWeak headers often come with other exposure — check the full picture.

sgs.lv

3 scans since 7/17/2025

A+

Latest: 90/100

Total Scans

3

Latest Score

90/100

First Scan

7/17/2025

Last Scan

7/17/2025

Score Trend

Security score progression over 2 scans

Scan History

DateScoreCSPHeadersIssuesAction
Jul 17, 2025
A+ (90)
No
5/60View →
Jul 17, 2025
A+ (90)
No
5/60View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: A+ (90/100) for sgs.lv
HTML
<a href="https://headertest.com/results/sgs.lv" title="Security headers grade for sgs.lv — HeaderTest">
  <img src="https://headertest.com/api/badge/sgs.lv" alt="HeaderTest security grade: A+ (90/100) for sgs.lv" />
</a>
Markdown
[![HeaderTest security grade: A+ (90/100) for sgs.lv](https://headertest.com/api/badge/sgs.lv)](https://headertest.com/results/sgs.lv)