Domain History

www.mortgageapplicationservice.ie

Grade F · 36/100 · 3/7 security headers present

Security Score

36/ 100

Security Headers

3/ 7

CSP Violations

NoViolations

Issues Found

110Issues

Recommendations

2Available

Security

36 / 100

Significant security weaknesses detected in CSP configuration.

Compliance

70 / 100

Mostly compliant but some directives or headers are missing.

Best Practices

45 / 100

Few best practices adopted — significant room for improvement.

CSP Analysis

Content Security PolicyHIGH

frame-ancestors 'none';      default-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      script-src 'self' 'unsafe-inline' 'unsafe-eval' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      script-src-elem 'self' 'unsafe-inline' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      object-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      media-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      child-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      form-action 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      base-uri 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      worker-src 'self' blob: *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      manifest-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      connect-src 'self' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      img-src 'self' data: *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      style-src 'self' 'unsafe-inline' *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;      font-src 'self' data: *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com;

Directive Analysis

frame-ancestorsLOW

none

default-srcHIGH

self *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com

•Subdomain wildcard '*.doubleclick.net' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in default-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in default-src - vulnerable to subdomain takeover

script-srcHIGH

self unsafe-inline unsafe-eval *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com

•Unsafe inline execution allowed in script-src

•Unsafe eval() execution allowed in script-src

•Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in script-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeover

•No nonces or hashes used for script-src

script-src-elemHIGH

self unsafe-inline *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com

•Unsafe inline execution allowed in script-src-elem

•Subdomain wildcard '*.doubleclick.net' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in script-src-elem - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in script-src-elem - vulnerable to subdomain takeover

object-srcHIGH

•Subdomain wildcard '*.doubleclick.net' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in object-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in object-src - vulnerable to subdomain takeover

media-srcHIGH

•Subdomain wildcard '*.doubleclick.net' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in media-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in media-src - vulnerable to subdomain takeover

child-srcHIGH

•Subdomain wildcard '*.doubleclick.net' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in child-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in child-src - vulnerable to subdomain takeover

form-actionHIGH

•Subdomain wildcard '*.doubleclick.net' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in form-action - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in form-action - vulnerable to subdomain takeover

base-uriHIGH

•Subdomain wildcard '*.doubleclick.net' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in base-uri - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in base-uri - vulnerable to subdomain takeover

worker-srcHIGH

self blob: *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com

•Info: 'blob:' URI in worker-src

•Subdomain wildcard '*.doubleclick.net' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in worker-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in worker-src - vulnerable to subdomain takeover

•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob content

manifest-srcHIGH

•Subdomain wildcard '*.doubleclick.net' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in manifest-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in manifest-src - vulnerable to subdomain takeover

connect-srcHIGH

•Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeover

img-srcHIGH

self data: *.doubleclick.net *.qualtrics.com *.cookielaw.org *.onetrust.com *.google.com *.googlesyndication.com *.google-analytics.com https://www.google-analytics.com https://www.google.com https://www.google.ro https://www.google.co.uk https://www.google.ie https://www.googletagmanager.com https://connect.facebook.net https://www.facebook.com https://www.gstatic.com

•Info: 'data:' URI in img-src

•Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in img-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeover

style-srcHIGH

•Unsafe inline execution allowed in style-src

•Subdomain wildcard '*.doubleclick.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in style-src - vulnerable to subdomain takeover

font-srcHIGH

•Info: 'data:' URI in font-src

•Subdomain wildcard '*.doubleclick.net' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.qualtrics.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cookielaw.org' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.onetrust.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.googlesyndication.com' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.google-analytics.com' in font-src - vulnerable to subdomain takeover

Security Headers

✗Cross-Origin-Opener-PolicyMissing

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

How to add it:

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;

apache

Header always set Cross-Origin-Opener-Policy "same-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✗X-Frame-OptionsMissing

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

How to add it:

nginx

add_header X-Frame-Options "DENY" always;

apache

Header always set X-Frame-Options "DENY"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set X-Frame-Options to "DENY"

—X-XSS-ProtectionDeprecated

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

3 recommended security headers are missing on www.mortgageapplicationservice.ie.

Issues Found

•Info: 'blob:' URI in worker-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Missing security header: Cross-Origin-Opener-Policymedium
•Missing security header: Permissions-Policymedium
•Missing security header: X-Frame-Optionsmedium
•No nonces or hashes used for script-srcmedium
•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob contentmedium
•Subdomain wildcard '*.cookielaw.org' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cookielaw.org' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.doubleclick.net' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google-analytics.com' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.google.com' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.googlesyndication.com' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.onetrust.com' in worker-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in base-uri - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in child-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in default-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in form-action - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in img-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in manifest-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in media-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in object-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in script-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in script-src-elem - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.qualtrics.com' in worker-src - vulnerable to subdomain takeovermedium
•Unsafe eval() execution allowed in script-srchigh
•Unsafe inline execution allowed in script-srchigh
•Unsafe inline execution allowed in script-src-elemhigh
•Unsafe inline execution allowed in style-srchigh

Recommendations

→Consider implementing a stricter Content Security Policy
→Replace wildcards (*) with specific source lists

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about www.mortgageapplicationservice.ieWeak headers often come with other exposure — check the full picture.

See full exposure report on OSN →Free, no signup.