Domain History
sostena.lt
Grade A · 80/100 · 4/6 security headers present
Security Score
A
80/ 100
Security Headers
4/ 6
CSP Violations
NoViolations
Issues Found
0Issues
Recommendations
0Available
CSP Analysis
Content Security PolicyHIGH
default-src 'self' ; connect-src 'self' wss: * ; font-src 'self' fonts.gstatic.com use.fontawesome.com webshop.abahn.net ccchat.estpak.ee embed.tawk.to data: ; img-src blob: data: http: https: 'self' ; script-src 'self' cdn.modera.org *.salesfront.eu modera-serverless-microservices-assets.s3.eu-north-1.amazonaws.com www.google-analytics.com ssl.google-analytics.com www.googletagmanager.com www.googleadservices.com googleads.g.doubleclick.net www.google.com www.youtube.com www.gstatic.com connect.facebook.net consent.cookiebot.com consentcdn.cookiebot.com static.zdassets.com cdnjs.cloudflare.com cdn.jsdelivr.net code.jquery.com ajax.googleapis.com maps.googleapis.com maps.google.com webshop.abahn.net banners.adnetmedia.lt mediabrands.containers.piwik.pro services.digitalmatter.ai scdn.cxense.com id.cxense.com track.adform.net s2.adform.net static.hotjar.com script.hotjar.com cdn.visitor.chat ccchat.estpak.ee snap.licdn.com cdn-cookieyes.com analytics.tiktok.com pagead2.googlesyndication.com embed.tawk.to plausible.io www.redditstatic.com delfilt.adocean.pl 'unsafe-inline' 'unsafe-eval' ; style-src data: 'self' cdn.modera.org *.salesfront.eu fonts.googleapis.com cdnjs.cloudflare.com cdn.jsdelivr.net webshop.abahn.net use.fontawesome.com ccchat.estpak.ee embed.tawk.to 'unsafe-inline' ; media-src http: https: 'self' ; base-uri 'self' ; object-src 'none' ; frame-src http: https: 'self'; upgrade-insecure-requests ; block-all-mixed-content;
Directive Analysis
default-srcLOW
'self'
•Missing recommended values for default-src: self
connect-srcHIGH
'self' wss: *
•Overly permissive wildcard (*) in connect-src
•Missing recommended values for connect-src: self
font-srcLOW
embed.tawk.to ccchat.estpak.ee use.fontawesome.com 'self' fonts.gstatic.com data: webshop.abahn.net
•Missing recommended values for font-src: self
img-srcMEDIUM
https: http: blob: 'self' data:
•Insecure HTTP source allowed in img-src
•Missing recommended values for img-src: self
script-srcHIGH
www.googletagmanager.com s2.adform.net scdn.cxense.com code.jquery.com connect.facebook.net consentcdn.cookiebot.com www.redditstatic.com www.youtube.com webshop.abahn.net mediabrands.containers.piwik.pro www.google.com www.googleadservices.com 'self' ajax.googleapis.com banners.adnetmedia.lt id.cxense.com *.salesfront.eu cdn.jsdelivr.net maps.googleapis.com pagead2.googlesyndication.com 'unsafe-inline' modera-serverless-microservices-assets.s3.eu-north-1.amazonaws.com www.google-analytics.com track.adform.net cdn-cookieyes.com 'unsafe-eval' snap.licdn.com cdn.visitor.chat cdn.modera.org ssl.google-analytics.com embed.tawk.to ccchat.estpak.ee delfilt.adocean.pl script.hotjar.com googleads.g.doubleclick.net analytics.tiktok.com plausible.io maps.google.com static.zdassets.com cdnjs.cloudflare.com services.digitalmatter.ai static.hotjar.com consent.cookiebot.com www.gstatic.com
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Missing recommended values for script-src: self, sha256-, sha512-, sha384-, nonce-
•No nonces or hashes used for script-src
style-srcHIGH
cdn.modera.org embed.tawk.to cdn.jsdelivr.net ccchat.estpak.ee use.fontawesome.com 'self' 'unsafe-inline' fonts.googleapis.com cdnjs.cloudflare.com *.salesfront.eu data: webshop.abahn.net
•Unsafe inline execution allowed in style-src
•Missing recommended values for style-src: self, sha256-, sha512-, sha384-, nonce-
media-srcMEDIUM
'self' http: https:
•Insecure HTTP source allowed in media-src
•Missing recommended values for media-src: self
base-uriLOW
'self'
•Missing recommended values for base-uri: self, none
object-srcLOW
'none'
•Missing recommended values for object-src: none
frame-srcMEDIUM
'self' http: https:
•Insecure HTTP source allowed in frame-src
•Missing recommended values for frame-src: self
upgrade-insecure-requestsLOW
block-all-mixed-contentLOW
Security Headers
✗Permissions-PolicyMissing
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value✓Referrer-PolicyPresent
no-referrer, strict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=16070400; includeSubDomains
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✗X-Frame-OptionsMissing
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
How to add it:
nginx
add_header X-Frame-Options "DENY" always;apache
Header always set X-Frame-Options "DENY"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"✓X-XSS-ProtectionPresent
0
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
2 recommended security headers are missing on sostena.lt.
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about sostena.ltWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
sostena.lt
3 scans since 7/17/2025
A
Latest: 80/100
Total Scans
3
Latest Score
80/100
First Scan
7/17/2025
Last Scan
7/17/2025
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/sostena.lt" title="Security headers grade for sostena.lt — HeaderTest">
<img src="https://headertest.com/api/badge/sostena.lt" alt="HeaderTest security grade: A (80/100) for sostena.lt" />
</a>Markdown
[](https://headertest.com/results/sostena.lt)