Domain History
sparkasse.de
Grade F · 34/100 · 4/7 security headers present
Security Score
F
34/ 100
Security Headers
4/ 7
CSP Violations
NoViolations
Issues Found
52Issues
Recommendations
4Available
Security
34 / 100Significant security weaknesses detected in CSP configuration.
Compliance
75 / 100Mostly compliant but some directives or headers are missing.
Best Practices
25 / 100Best practices largely absent — review CSP configuration.
CSP Analysis
Content Security PolicyHIGH
default-src 'self' amazon-adsystem.com *.amazon-adsystem.com paa-reporting-advertising.amazon *.paa-reporting-advertising.amazon; script-src 'unsafe-inline' 'unsafe-eval' 'self' www.googletagmanager.com www.yellowmap.de cdn.yellowmap.de cdn.trustcommander.net www.youtube.com www.google-analytics.com *.doubleclick.net connect.facebook.net assets.adobedtm.com adobedc.demdex.net edge.adobedc.net *.adform.net static.hotjar.com script.hotjar.com *.amazon-adsystem.com t23.intelliad.de *.outbrain.com *.helixjobs.com bt.fraud0.com *.fraud0.com; style-src 'self' 'unsafe-inline' cdn.yellowmap.de static.hotjar.com script.hotjar.com *.helixjobs.com; connect-src 'self' *.sparkasse.de autocomplete.smartmaps.cloud events.flagship.io *.yellowmap.de *.trustcommander.net *.commander1.com *.google-analytics.com *.analytics.google.com *.doubleclick.net *.sparkassen-finanzportal.de eu-api.friendlycaptcha.eu www.facebook.com assets.adobedtm.com adobedc.demdex.net edge.adobedc.net *.hotjar.com *.hotjar.io wss://*.hotjar.com www.google.com/ccm/collect *.paa-reporting-advertising.amazon *.amazon-adsystem.com *.sentry.io api.sparkassen-mediacenter.de cdn.sparkassen-mediacenter.de sparkassen-mediacenter.de *.outbrain.com *.fraud0.com t.uimserv.net; img-src data: 'self' 'unsafe-inline' i.ytimg.com map.iib-institut.de *.yellowmaps.eu tiles.smartmaps.cloud www.yellowmap.de *.sparkasse.de *.trustcommander.net *.commander1.com img.youtube.com *.google-analytics.com *.analytics.google.com www.googletagmanager.com www.google.com www.google.de api.sparkassen-mediacenter.de kvp-skmc.dbc-gmbh.com *.doubleclick.net images.podigee-cdn.net feeds.sparkassen-finanzportal.de events.flagship.io www.facebook.com widgets.kununu.com assets.kununu.com alias.maptoolkit.net cdn.sparkassen-mediacenter.de static.hotjar.com script.hotjar.com survey-images.hotjar.com api.immobilie1.de cdn.immobilie1.de *.outbrain.com *.fraud0.com portal.fio.de cdnihddipa.cloudimg.io t.uimserv.net; media-src 'self' blob: api.sparkassen-mediacenter.de cdn.sparkassen-mediacenter.de sparkassen-mediacenter.de kvp-skmc.dbc-gmbh.com youtu.be www.youtube.com youtube.com; frame-src data: 'self' cdn.trustcommander.net widget.civey.com sparkasse.linda-chatbot.de www.youtube.com player.podigee-cdn.net td.doubleclick.net www.googletagmanager.com s-tag.sparkasse.de *.amazon-adsystem.com *.helixjobs.com; font-src data: 'self' webfonts.sparkasse.de cdn.yellowmap.de *.hotjar.com; object-src 'self'; manifest-src 'self'; worker-src 'self' blob:; frame-ancestors 'self' *.content-manager.sparkasse.de;
Directive Analysis
default-srcHIGH
self amazon-adsystem.com *.amazon-adsystem.com paa-reporting-advertising.amazon *.paa-reporting-advertising.amazon
•Subdomain wildcard '*.amazon-adsystem.com' in default-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.paa-reporting-advertising.amazon' in default-src - vulnerable to subdomain takeover
script-srcHIGH
unsafe-inline unsafe-eval self www.googletagmanager.com www.yellowmap.de cdn.yellowmap.de cdn.trustcommander.net www.youtube.com www.google-analytics.com *.doubleclick.net connect.facebook.net assets.adobedtm.com adobedc.demdex.net edge.adobedc.net *.adform.net static.hotjar.com script.hotjar.com *.amazon-adsystem.com t23.intelliad.de *.outbrain.com *.helixjobs.com bt.fraud0.com *.fraud0.com
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.adform.net' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.amazon-adsystem.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.outbrain.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.helixjobs.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.fraud0.com' in script-src - vulnerable to subdomain takeover
•No nonces or hashes used for script-src
style-srcHIGH
self unsafe-inline cdn.yellowmap.de static.hotjar.com script.hotjar.com *.helixjobs.com
•Unsafe inline execution allowed in style-src
•Subdomain wildcard '*.helixjobs.com' in style-src - vulnerable to subdomain takeover
connect-srcHIGH
self *.sparkasse.de autocomplete.smartmaps.cloud events.flagship.io *.yellowmap.de *.trustcommander.net *.commander1.com *.google-analytics.com *.analytics.google.com *.doubleclick.net *.sparkassen-finanzportal.de eu-api.friendlycaptcha.eu www.facebook.com assets.adobedtm.com adobedc.demdex.net edge.adobedc.net *.hotjar.com *.hotjar.io wss://*.hotjar.com www.google.com/ccm/collect *.paa-reporting-advertising.amazon *.amazon-adsystem.com *.sentry.io api.sparkassen-mediacenter.de cdn.sparkassen-mediacenter.de sparkassen-mediacenter.de *.outbrain.com *.fraud0.com t.uimserv.net
•Subdomain wildcard '*.sparkasse.de' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.yellowmap.de' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.trustcommander.net' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.commander1.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.analytics.google.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.sparkassen-finanzportal.de' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.hotjar.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.hotjar.io' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.paa-reporting-advertising.amazon' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.amazon-adsystem.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.sentry.io' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.outbrain.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.fraud0.com' in connect-src - vulnerable to subdomain takeover
img-srcHIGH
data: self unsafe-inline i.ytimg.com map.iib-institut.de *.yellowmaps.eu tiles.smartmaps.cloud www.yellowmap.de *.sparkasse.de *.trustcommander.net *.commander1.com img.youtube.com *.google-analytics.com *.analytics.google.com www.googletagmanager.com www.google.com www.google.de api.sparkassen-mediacenter.de kvp-skmc.dbc-gmbh.com *.doubleclick.net images.podigee-cdn.net feeds.sparkassen-finanzportal.de events.flagship.io www.facebook.com widgets.kununu.com assets.kununu.com alias.maptoolkit.net cdn.sparkassen-mediacenter.de static.hotjar.com script.hotjar.com survey-images.hotjar.com api.immobilie1.de cdn.immobilie1.de *.outbrain.com *.fraud0.com portal.fio.de cdnihddipa.cloudimg.io t.uimserv.net
•Info: 'data:' URI in img-src
•Unsafe inline execution allowed in img-src
•Subdomain wildcard '*.yellowmaps.eu' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.sparkasse.de' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.trustcommander.net' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.commander1.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.analytics.google.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.outbrain.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.fraud0.com' in img-src - vulnerable to subdomain takeover
media-srcLOW
self blob: api.sparkassen-mediacenter.de cdn.sparkassen-mediacenter.de sparkassen-mediacenter.de kvp-skmc.dbc-gmbh.com youtu.be www.youtube.com youtube.com
•Info: 'blob:' URI in media-src
frame-srcHIGH
data: self cdn.trustcommander.net widget.civey.com sparkasse.linda-chatbot.de www.youtube.com player.podigee-cdn.net td.doubleclick.net www.googletagmanager.com s-tag.sparkasse.de *.amazon-adsystem.com *.helixjobs.com
•Info: 'data:' URI in frame-src
•Subdomain wildcard '*.amazon-adsystem.com' in frame-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.helixjobs.com' in frame-src - vulnerable to subdomain takeover
font-srcMEDIUM
data: self webfonts.sparkasse.de cdn.yellowmap.de *.hotjar.com
•Info: 'data:' URI in font-src
•Subdomain wildcard '*.hotjar.com' in font-src - vulnerable to subdomain takeover
object-srcLOW
self
manifest-srcLOW
self
worker-srcMEDIUM
self blob:
•Info: 'blob:' URI in worker-src
•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob content
frame-ancestorsMEDIUM
self *.content-manager.sparkasse.de
•Subdomain wildcard '*.content-manager.sparkasse.de' in frame-ancestors - vulnerable to subdomain takeover
Missing Directives
⚠HIGHMissing HIGH directive base-uri (Base URI control - prevents base tag injection)
⚠MEDIUMMissing MEDIUM directive form-action (Form submission control - prevents form hijacking)
Security Headers
✗Cross-Origin-Opener-PolicyMissing
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
nginx
add_header Cross-Origin-Opener-Policy "same-origin" always;apache
Header always set Cross-Origin-Opener-Policy "same-origin"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"✓Permissions-PolicyPresent
fullscreen=(self "https://www.youtube.com" "https://youtu.be"), geolocation=(self), camera=(), microphone=()
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
✓Referrer-PolicyPresent
origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✗X-Frame-OptionsMissing
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
How to add it:
nginx
add_header X-Frame-Options "DENY" always;apache
Header always set X-Frame-Options "DENY"cloudflare
Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"—X-XSS-ProtectionDeprecated
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
2 recommended security headers are missing on sparkasse.de.
Issues Found
- •Info: 'blob:' URI in media-srcinfo
- •Info: 'blob:' URI in worker-srcinfo
- •Info: 'data:' URI in font-srcinfo
- •Info: 'data:' URI in frame-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Missing HIGH directive base-uri (Base URI control - prevents base tag injection)high
- •Missing MEDIUM directive form-action (Form submission control - prevents form hijacking)medium
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: X-Frame-Optionsmedium
- •No nonces or hashes used for script-srcmedium
- •RISK: 'blob:' in worker-src allows creation of workers from dynamic blob contentmedium
- •Subdomain wildcard '*.adform.net' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.amazon-adsystem.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.amazon-adsystem.com' in default-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.amazon-adsystem.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.amazon-adsystem.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.analytics.google.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.analytics.google.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.commander1.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.commander1.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.content-manager.sparkasse.de' in frame-ancestors - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.fraud0.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.fraud0.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.fraud0.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.helixjobs.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.helixjobs.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.helixjobs.com' in style-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.hotjar.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.hotjar.com' in font-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.hotjar.io' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.outbrain.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.outbrain.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.outbrain.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.paa-reporting-advertising.amazon' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.paa-reporting-advertising.amazon' in default-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.sentry.io' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.sparkasse.de' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.sparkasse.de' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.sparkassen-finanzportal.de' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.trustcommander.net' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.trustcommander.net' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.yellowmap.de' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.yellowmaps.eu' in img-src - vulnerable to subdomain takeovermedium
- •Unsafe eval() execution allowed in script-srchigh
- •Unsafe inline execution allowed in img-srchigh
- •Unsafe inline execution allowed in script-srchigh
- •Unsafe inline execution allowed in style-srchigh
Recommendations
- →Add base-uri directive with appropriate restrictions
- →Add form-action directive with appropriate restrictions
- →Consider implementing a stricter Content Security Policy
- →Replace wildcards (*) with specific source lists
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about sparkasse.deWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
sparkasse.de
6 scans since 5/11/2026
F
Latest: 34/100
Total Scans
6
Latest Score
34/100
First Scan
5/11/2026
Last Scan
9/29/2026
Security
34 / 100Significant security weaknesses detected in CSP configuration.
Compliance
75 / 100Mostly compliant but some directives or headers are missing.
Best Practices
25 / 100Best practices largely absent — review CSP configuration.
Score Trend
Security score progression over 6 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/sparkasse.de" title="Security headers grade for sparkasse.de — HeaderTest">
<img src="https://headertest.com/api/badge/sparkasse.de" alt="HeaderTest security grade: F (34/100) for sparkasse.de" />
</a>Markdown
[](https://headertest.com/results/sparkasse.de)