sgs.lv
Grade A+ · 90/100 · 5/6 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
CSP Analysis
default-src 'self' 'unsafe-inline' *.coveo.com *.google-analytics.com *.google.com *.googletagmanager.com *.imgix.net *.leadoo.com *.sgs.com *.sgsgroup.com.cn cdn.cookielaw.org cdn.jsdelivr.net f7132108c1tst-store.occa.ocs.oraclecloud.com1 fonts.googleapis.com jobpal-sm.s3.amazonaws.com pagead2.googlesyndication.com; font-src 'self' data: *.googleapis.com *.gstatic.com *.hotjar.com *.hotjar.io *.smooch.io jobpal-sm.s3.amazonaws.com res.leadoo.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.baidu.com *.beyondwords.io *.cloudfront.net *.cookielaw.org *.coveo.com *.doubleclick.net *.eloqua.com *.en25.com *.facebook.com *.google-analytics.com *.google.com *.googleadservices.com *.googleanalytics.com *.googleoptimize.com *.googletagmanager.com *.gstatic.com *.hotjar.com *.hotjar.io *.leadoo.com *.mapbox.com *.sgsmall.com.cn *.sgsonline.com.cn *.smooch.io *.storerocket.io *.youtube.com cdn.jsdelivr.net https://challenges.cloudflare.com https://connect.facebook.net https://content.linkedin.com https://maps.googleapis.com https://platform.linkedin.com https://snap.licdn.com https://static-exp1.licdn.com https://storemapper-herokuapp-com.global.ssl.fastly.net https://unpkg.com https://www.recaptcha.net https://www.storemapper.co jobpal-sm.s3.amazonaws.com pagead2.googlesyndication.com s.go-mpulse.net; style-src 'self' 'unsafe-inline' *.google.com https://fonts.googleapis.com jobpal-sm.s3.amazonaws.com *.leadoo.com *.sgs-next.com *.coveo.com https://maps.googleapis.com *.cloudfront.net; frame-src 'self' tools.eurolandir.com *.google.com youtu.be *.sgs.com *.youtube.com *.youtube-nocookie.com *.hotjar.com *.sgs.com *.sgs.pl *.sgsgroup.com.cn *.hotjar.com *.hotjar.io *.smooch.io *.doubleclick.net *.linkedin.com *.facebook.com connect.facebook.net *.leadoo.com https://www.recaptcha.net *.doubleclick.net https://*.acast.com *.spotify.com https://view.genial.ly *.baidu.com https://challenges.cloudflare.com *.flippingbook.com *.sgsonline.com.cn *.genially.com; child-src 'self' *.youtube-nocookie.com *.youtube.com v.qq.com *.google.com *.sgs.com *.facebook.com connect.facebook.net; frame-ancestors 'self' *.googletagmanager.com *.sgs.com *.sgs.pl *.flippingbook.com; connect-src 'self' *.sgsgroup.com.cn *.sgs.com *.sgs-next.com f7132108c1tst-store.occa.ocs.oraclecloud.com cdn.cookielaw.org *.leadoo.com anl.leadoo.com pagead2.googlesyndication.com *.google-analytics.com *.google.com *.doubleclick.net privacyportal-de.onetrust.com *.go-mpulse.net jobpal-sm.s3.amazonaws.com *.hotjar.com *.hotjar.io wss://ws.hotjar.com *.smooch.io *.googletagmanager.com *.linkedin.com *.licdn.com *.facebook.com connect.facebook.net *.akstat.io https://cdn.linkedin.oribi.io https://geolocation.onetrust.com *.coveo.com https://*.beyondwords.io https://maps.googleapis.com *.cloudfront.net *.flippingbook.com *.sgsonline.com.cn storerocket.io *.mapbox.com; img-src 'self' data: *.sgsgroup.com.cn *.sgs.com *.sgs-next.com *.imgix.net *.leadoo.com *.eloqua.com i.ytimg.com cdn.cookielaw.org *.cdninstagram.com *.hotjar.com *.hotjar.io *.doubleclick.net *.smooch.io *.gstatic.com *.linkedin.com *.licdn.com p.adsymptotic.com *.facebook.com *.facebook.net *.fbcdn.net *.google.com *.googlesyndication.com *.googletagmanager.com *.google-analytics.com *.baidu.com *.cpsc.gov *.productsafety.gov.au ec.europa.eu https://maps.googleapis.com *.cloudfront.net *.sgsonline.com.cn *.google.ca *.google.de *.google.pl *.google.co.in *.google.es *.google.nl *.google.be *.google.com.hk *.google.com.au *.google.com.br *.google.co.za *.google.ae *.google.com.co *.google.com.pe *.google.com.sg *.google.ch *.google.com.tr *.google.co.id *.google.pt *.google.hu *.google.ro *.google.co.uk *.google.co.th *.google.fr *.google.com.tw *.google.com.my *.google.com.mx *.google.co.nz *.storerocket.io; worker-src 'self' https: blob:; media-src 'self' blob: media.licdn.com *.cloudfront.net; form-action 'self' *.facebook.com connect.facebook.net;
Directive Analysis
Security Headers
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valuestrict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
max-age=86400
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
1 recommended security header is missing on sgs.lv.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
sgs.lv
3 scans since 7/17/2025
Latest: 90/100
Total Scans
3
Latest Score
90/100
First Scan
7/17/2025
Last Scan
7/17/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/sgs.lv" title="Security headers grade for sgs.lv — HeaderTest">
<img src="https://headertest.com/api/badge/sgs.lv" alt="HeaderTest security grade: A+ (90/100) for sgs.lv" />
</a>[](https://headertest.com/results/sgs.lv)