Domain History

varonis.io

Grade D- · 48/100 · 4/7 security headers present

Security Score

D-

48/ 100

Security Headers

4/ 7

CSP Violations

NoViolations

Issues Found

161Issues

Recommendations

2Available

Security

48 / 100

Significant security weaknesses detected in CSP configuration.

Compliance

80 / 100

Mostly compliant but some directives or headers are missing.

Best Practices

68 / 100

Basic practices followed but missing important optimizations.

CSP Analysis

Content Security PolicyHIGH

default-src   'self';  script-src   'self'   'unsafe-inline'   'unsafe-eval'   blob:   *.6sc.co   *.a.net   *.ads-twitter.com   *.bing.com   *.bizible.com   *.cloudflare.com   *.doubleclick.net   *.facebook.net   *.google-analytics.com   *.google.com   *.googletagmanager.com   *.hs-analytics.net   *.hs-banner.com   *.hsadspixel.net   *.hsappstatic.net   *.hscollectedforms.net   *.hsforms.com   *.hsforms.net   *.hsleadflows.net   *.hs-scripts.com   *.hubspot.com   *.hubspot.net   *.hubspotfeedback.com   *.hubspotusercontent00.net   *.hubspotusercontent10.net   *.hubspotusercontent20.net   *.hubspotusercontent30.net   *.hubspotusercontent40.net   *.jquery.com   *.jsdelivr.net   *.ktxlytics.io   *.linkedin.com   *.licdn.com   *.redditstatic.com   *.salesloft.com   *.sentry-cdn.com   *.stackadapt.com   *.twitter.com   *.usemessages.com   *.varonis.com   *.wistia.com   *.wistia.net   *.zi-scripts.com   cdn.boomtrain.com   dreamdata.min.js   feedback-eu1.hubapi.com   feedback.hubapi.com   js-eu1.hscta.net   js.hscta.net   live.rezync.com   plausible.io   qvdt3feo.com   static.hsappstatic.net   tracking-api.g2.com   unpkg.com   https://cdn.drda.io/scripts/analytics/next/dreamdata.cl.min.js   https://c1.rfihub.net/js/tc.min.js   https://www.youtube.com/iframe_api;  style-src   'self'   'unsafe-inline'   *.cloudflare.com   *.google.com   *.googleapis.com   *.hsappstatic.net   *.hubspot.net   *.hubspotusercontent00.net   *.hubspotusercontent10.net   *.hubspotusercontent20.net   *.hubspotusercontent30.net   *.hubspotusercontent40.net   *.jsdelivr.net   *.stackadapt.com   *.varonis.com   cdn2.hubspot.net;  img-src   'self'   data:   blob:   *.6sc.co   *.adnxs.com   *.adsrvr.org   *.bing.com   *.bizible.com   *.bizibly.com   *.doubleclick.net   *.facebook.com   *.g2.com   *.g2crowd.com   *.google-analytics.com   *.google.com   *.googletagmanager.com   *.hsforms.com   *.hsforms.net   *.hubspot.com   *.hubspot.net   *.hubspotusercontent-na1.net   *.hubspotusercontent00.net   *.hubspotusercontent10.net   *.hubspotusercontent20.net   *.hubspotusercontent30.net   *.hubspotusercontent40.net   *.ktxlytics.io   *.linkedin.com   *.reddit.com   *.twitter.com   *.varonis.com   *.wistia.com   *.wistia.net   *.youtube.com   *.ytimg.com   js-eu1.hscta.net   js.hscta.net   no-cache.hubspot.com   static.hsappstatic.net   i.liadm.com   live.rezync.com   t.co;  font-src   'self'   data:   *.gstatic.com   *.googleapis.com   *.hubspotusercontent-na1.net   *.hsappstatic.net   *.varonis.com   *.wistia.com   *.wistia.net;  connect-src   'self'   *.6sc.co   *.boomtrain.com   *.cloudflare.com   *.doubleclick.net   *.g2.com   *.google-analytics.com   *.google.com   *.hs-banner.com   *.hsappstatic.net   *.hscollectedforms.net   *.hsforms.com   *.hsforms.net   *.hubapi.com   *.hubspot.com   *.hubspotusercontent-na1.net   *.zi-scripts.com   *.ktxlytics.io   *.linkedin.com   *.litix.io   *.reddit.com   *.redditstatic.com   *.salesloft.com   *.stackadapt.com   *.varonis.com   *.wistia.com   *.wistia.net   *.zoominfo.com   js-eu1.hscta.net   js.hscta.net   unpkg.com   cdn.jsdelivr.net   epsilon.6sense.com   plausible.io   https://events.api.boomtrain.com/event/track   https://cdn.dreamdata.cloud/api/v1/p;  media-src   'self'   blob:   *.varonis.com   *.wistia.com   *.wistia.net   *.youtube.com   *.ytimg.com;  object-src   'none';  frame-src   'self'   *.facebook.com   *.googletagmanager.com   *.hs-sites-eu1.com   *.hs-sites.com   *.hsforms.com   *.hsforms.net   *.hubspot.com   *.hubspot.net   *.podcasts.apple.com   *.rfihub.com   *.twitter.com   *.varonis.com   *.vimeo.com   *.wistia.com   *.wistia.net   *.youtube.com   *.yt.com   play-eu1.hubspotvideo.com   play.hubspotvideo.com   www.youtube-nocookie.com;  worker-src   'self'   *.hsforms.com;  base-uri   'self';  form-action   'self'   *.hsforms.com   *.hsforms.net;  frame-ancestors   'none';  upgrade-insecure-requests;  block-all-mixed-content;

Directive Analysis

default-srcLOW

self

script-srcHIGH

self unsafe-inline unsafe-eval blob: *.6sc.co *.a.net *.ads-twitter.com *.bing.com *.bizible.com *.cloudflare.com *.doubleclick.net *.facebook.net *.google-analytics.com *.google.com *.googletagmanager.com *.hs-analytics.net *.hs-banner.com *.hsadspixel.net *.hsappstatic.net *.hscollectedforms.net *.hsforms.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspot.com *.hubspot.net *.hubspotfeedback.com *.hubspotusercontent00.net *.hubspotusercontent10.net *.hubspotusercontent20.net *.hubspotusercontent30.net *.hubspotusercontent40.net *.jquery.com *.jsdelivr.net *.ktxlytics.io *.linkedin.com *.licdn.com *.redditstatic.com *.salesloft.com *.sentry-cdn.com *.stackadapt.com *.twitter.com *.usemessages.com *.varonis.com *.wistia.com *.wistia.net *.zi-scripts.com cdn.boomtrain.com dreamdata.min.js feedback-eu1.hubapi.com feedback.hubapi.com js-eu1.hscta.net js.hscta.net live.rezync.com plausible.io qvdt3feo.com static.hsappstatic.net tracking-api.g2.com unpkg.com https://cdn.drda.io/scripts/analytics/next/dreamdata.cl.min.js https://c1.rfihub.net/js/tc.min.js https://www.youtube.com/iframe_api

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobs

•Subdomain wildcard '*.6sc.co' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.a.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ads-twitter.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.bing.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.bizible.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cloudflare.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.facebook.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googletagmanager.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-analytics.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-banner.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsadspixel.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsappstatic.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hscollectedforms.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsleadflows.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-scripts.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotfeedback.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent00.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent10.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent20.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent30.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent40.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.jquery.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.jsdelivr.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ktxlytics.io' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.linkedin.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.licdn.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.redditstatic.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.salesloft.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.sentry-cdn.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.stackadapt.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.twitter.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.usemessages.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.zi-scripts.com' in script-src - vulnerable to subdomain takeover

•HIGH RISK CDN: 'unpkg.com' in script-src - Hosts arbitrary npm packages that can serve malicious code

•No nonces or hashes used for script-src

⚠unpkg.com: Hosts arbitrary npm packages that can serve malicious code

style-srcHIGH

self unsafe-inline *.cloudflare.com *.google.com *.googleapis.com *.hsappstatic.net *.hubspot.net *.hubspotusercontent00.net *.hubspotusercontent10.net *.hubspotusercontent20.net *.hubspotusercontent30.net *.hubspotusercontent40.net *.jsdelivr.net *.stackadapt.com *.varonis.com cdn2.hubspot.net

•Unsafe inline execution allowed in style-src

•Subdomain wildcard '*.cloudflare.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googleapis.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsappstatic.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent00.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent10.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent20.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent30.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent40.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.jsdelivr.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.stackadapt.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in style-src - vulnerable to subdomain takeover

img-srcHIGH

self data: blob: *.6sc.co *.adnxs.com *.adsrvr.org *.bing.com *.bizible.com *.bizibly.com *.doubleclick.net *.facebook.com *.g2.com *.g2crowd.com *.google-analytics.com *.google.com *.googletagmanager.com *.hsforms.com *.hsforms.net *.hubspot.com *.hubspot.net *.hubspotusercontent-na1.net *.hubspotusercontent00.net *.hubspotusercontent10.net *.hubspotusercontent20.net *.hubspotusercontent30.net *.hubspotusercontent40.net *.ktxlytics.io *.linkedin.com *.reddit.com *.twitter.com *.varonis.com *.wistia.com *.wistia.net *.youtube.com *.ytimg.com js-eu1.hscta.net js.hscta.net no-cache.hubspot.com static.hsappstatic.net i.liadm.com live.rezync.com t.co

•Info: 'data:' URI in img-src

•Info: 'blob:' URI in img-src

•Subdomain wildcard '*.6sc.co' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.adnxs.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.adsrvr.org' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.bing.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.bizible.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.bizibly.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.facebook.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.g2.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.g2crowd.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googletagmanager.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent-na1.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent00.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent10.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent20.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent30.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent40.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ktxlytics.io' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.linkedin.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.reddit.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.twitter.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ytimg.com' in img-src - vulnerable to subdomain takeover

font-srcHIGH

self data: *.gstatic.com *.googleapis.com *.hubspotusercontent-na1.net *.hsappstatic.net *.varonis.com *.wistia.com *.wistia.net

•Info: 'data:' URI in font-src

•Subdomain wildcard '*.gstatic.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googleapis.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent-na1.net' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsappstatic.net' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in font-src - vulnerable to subdomain takeover

connect-srcHIGH

self *.6sc.co *.boomtrain.com *.cloudflare.com *.doubleclick.net *.g2.com *.google-analytics.com *.google.com *.hs-banner.com *.hsappstatic.net *.hscollectedforms.net *.hsforms.com *.hsforms.net *.hubapi.com *.hubspot.com *.hubspotusercontent-na1.net *.zi-scripts.com *.ktxlytics.io *.linkedin.com *.litix.io *.reddit.com *.redditstatic.com *.salesloft.com *.stackadapt.com *.varonis.com *.wistia.com *.wistia.net *.zoominfo.com js-eu1.hscta.net js.hscta.net unpkg.com cdn.jsdelivr.net epsilon.6sense.com plausible.io https://events.api.boomtrain.com/event/track https://cdn.dreamdata.cloud/api/v1/p

•Subdomain wildcard '*.6sc.co' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.boomtrain.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cloudflare.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.g2.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-banner.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsappstatic.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hscollectedforms.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubapi.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspotusercontent-na1.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.zi-scripts.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ktxlytics.io' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.linkedin.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.litix.io' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.reddit.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.redditstatic.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.salesloft.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.stackadapt.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.zoominfo.com' in connect-src - vulnerable to subdomain takeover

media-srcHIGH

self blob: *.varonis.com *.wistia.com *.wistia.net *.youtube.com *.ytimg.com

•Info: 'blob:' URI in media-src

•Subdomain wildcard '*.varonis.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.ytimg.com' in media-src - vulnerable to subdomain takeover

object-srcLOW

none

frame-srcHIGH

self *.facebook.com *.googletagmanager.com *.hs-sites-eu1.com *.hs-sites.com *.hsforms.com *.hsforms.net *.hubspot.com *.hubspot.net *.podcasts.apple.com *.rfihub.com *.twitter.com *.varonis.com *.vimeo.com *.wistia.com *.wistia.net *.youtube.com *.yt.com play-eu1.hubspotvideo.com play.hubspotvideo.com www.youtube-nocookie.com

•Subdomain wildcard '*.facebook.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googletagmanager.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-sites-eu1.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hs-sites.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.net' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.hubspot.net' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.podcasts.apple.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.rfihub.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.twitter.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.varonis.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.vimeo.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.wistia.net' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.youtube.com' in frame-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.yt.com' in frame-src - vulnerable to subdomain takeover

worker-srcMEDIUM

self *.hsforms.com

•Subdomain wildcard '*.hsforms.com' in worker-src - vulnerable to subdomain takeover

base-uriLOW

self

form-actionHIGH

self *.hsforms.com *.hsforms.net

•Subdomain wildcard '*.hsforms.com' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.hsforms.net' in form-action - vulnerable to subdomain takeover

frame-ancestorsLOW

none

upgrade-insecure-requestsLOW

block-all-mixed-contentLOW

•Deprecated: 'block-all-mixed-content' has been removed from the spec. Use 'upgrade-insecure-requests' instead.

•Redundant: 'block-all-mixed-content' is unnecessary when 'upgrade-insecure-requests' is present.

Security Headers

✗Cross-Origin-Opener-PolicyMissing

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

How to add it:

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;

apache

Header always set Cross-Origin-Opener-Policy "same-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

—X-XSS-ProtectionDeprecated

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

2 recommended security headers are missing on varonis.io.

Issues Found

•Deprecated: 'block-all-mixed-content' has been removed from the spec. Use 'upgrade-insecure-requests' instead.info
•HIGH RISK CDN: 'unpkg.com' in script-src - Hosts arbitrary npm packages that can serve malicious codehigh
•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobshigh
•Info: 'blob:' URI in img-srcinfo
•Info: 'blob:' URI in media-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Missing security header: Cross-Origin-Opener-Policymedium
•Missing security header: Permissions-Policymedium
•No nonces or hashes used for script-srcmedium
•Redundant: 'block-all-mixed-content' is unnecessary when 'upgrade-insecure-requests' is present.info
•Subdomain wildcard '*.6sc.co' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.6sc.co' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.6sc.co' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.a.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.adnxs.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ads-twitter.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.adsrvr.org' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.bing.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.bing.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.bizible.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.bizible.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.bizibly.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.boomtrain.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cloudflare.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cloudflare.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cloudflare.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.facebook.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.facebook.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.facebook.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.g2.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.g2.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.g2crowd.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googleapis.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googleapis.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googletagmanager.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googletagmanager.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googletagmanager.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.gstatic.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-analytics.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-banner.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-banner.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-scripts.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-sites-eu1.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hs-sites.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsadspixel.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsappstatic.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsappstatic.net' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsappstatic.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsappstatic.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hscollectedforms.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hscollectedforms.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.com' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.net' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.net' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsforms.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hsleadflows.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubapi.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.net' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspot.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotfeedback.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent-na1.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent-na1.net' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent-na1.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent00.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent00.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent00.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent10.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent10.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent10.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent20.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent20.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent20.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent30.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent30.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent30.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent40.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent40.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.hubspotusercontent40.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.jquery.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.jsdelivr.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.jsdelivr.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ktxlytics.io' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ktxlytics.io' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ktxlytics.io' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.licdn.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.linkedin.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.linkedin.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.linkedin.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.litix.io' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.podcasts.apple.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.reddit.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.reddit.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.redditstatic.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.redditstatic.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.rfihub.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.salesloft.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.salesloft.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.sentry-cdn.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.stackadapt.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.stackadapt.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.stackadapt.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.twitter.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.twitter.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.twitter.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.usemessages.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.varonis.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.vimeo.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.wistia.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.youtube.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.yt.com' in frame-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ytimg.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.ytimg.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.zi-scripts.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.zi-scripts.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.zoominfo.com' in connect-src - vulnerable to subdomain takeovermedium
•Unsafe eval() execution allowed in script-srchigh
•Unsafe inline execution allowed in script-srchigh
•Unsafe inline execution allowed in style-srchigh

Recommendations

→Consider implementing a stricter Content Security Policy
→Replace wildcards (*) with specific source lists

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about varonis.ioWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.

varonis.io

1 scan since 6/14/2026

D-

Latest: 48/100

Total Scans

Latest Score

48/100

First Scan

6/14/2026

Last Scan

6/14/2026

Security

48 / 100

Significant security weaknesses detected in CSP configuration.

Compliance

80 / 100

Mostly compliant but some directives or headers are missing.

Best Practices

68 / 100

Basic practices followed but missing important optimizations.

Scan History

Date	Score	CSP	Headers	Issues	Action
Jun 14, 2026	D- (48)	Yes	4/7	161	View →

Show off your security grade

Embed this badge on your site or README. It updates automatically after each scan and links back to this report.

HeaderTest security grade: D- (48/100) for varonis.io

HTML

<a href="https://headertest.com/results/varonis.io" title="Security headers grade for varonis.io — HeaderTest">
  <img src="https://headertest.com/api/badge/varonis.io" alt="HeaderTest security grade: D- (48/100) for varonis.io" />
</a>

Markdown

[![HeaderTest security grade: D- (48/100) for varonis.io](https://headertest.com/api/badge/varonis.io)](https://headertest.com/results/varonis.io)