Domain History
www.rt22.ch
Grade F · 38/100 · 7/7 security headers present
Security Score
F
38/ 100
Security Headers
7/ 7
CSP Violations
NoViolations
Issues Found
65Issues
Recommendations
2Available
Security
38 / 100Significant security weaknesses detected in CSP configuration.
Compliance
100 / 100CSP implementation follows recommended standards and specifications.
Best Practices
67 / 100Basic practices followed but missing important optimizations.
CSP Analysis
Content Security PolicyHIGH
base-uri 'self'; default-src 'self' data: www.google.com twitter.com wa.me www.facebook.com; manifest-src 'self'; script-src-attr 'unsafe-inline' static.cloudflareinsights.com; script-src 'unsafe-inline' 'unsafe-eval' blob: data: static.cloudflareinsights.com *.wp.com *.wordpress.com *.cm-wp.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.google.com *.gstatic.com api.w3-edge.com www.rt22.ch cdn.rt22.ch www.youtube.com cdn.jsdelivr.net kriesi.at connect.facebook.net platform.twitter.com player.vimeo.com cdn.syndication.twimg.com; script-src-elem 'self' data: blob: 'unsafe-inline' challenges.cloudflare.com app.formbricks.com gc.kis.v2.scr.kaspersky-labs.com *.cloudflare.com *.wp.com *.wordpress.com *.cm-wp.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.google.com *.gstatic.com api.w3-edge.com www.rt22.ch cdn.rt22.ch www.youtube.com cdn.jsdelivr.net kriesi.at connect.facebook.net platform.twitter.com player.vimeo.com cdn.syndication.twimg.com static.cloudflareinsights.com cdn.jquery.com;style-src 'self' data: 'unsafe-inline' *.wp.com *.wordpress.com *.google.com *.gstatic.com *.googleapis.com www.rt22.ch cdn.rt22.ch cdn.jsdelivr.net cdn-images.mailchimp.com; img-src 'self' data: blob: gtmetrix.com www.paypal.com previews.customer.envatousercontent.com repository.kreaturamedia.com *.google-analytics.com *.w.org *.wp.com *.cm-wp.com *.wordpress.com *.gravatar.com *.google.com *.gstatic.com *.googleapis.com *.freemius.com cdn.rt22.ch www.rt22.ch cdn.jsdelivr.net kriesi.at qr-code.ithemes.com www.paypalobjects.com image.thum.io layerslider.com; font-src 'self' data: *.gstatic.com cdn.rt22.ch www.rt22.ch cdn.jsdelivr.net cdn.ss-cdn.com; connect-src 'self' *.wordpress.com app.formbricks.com *.wp.com *.w.org api.w3-edge.com maps.googleapis.com www.google-analytics.com www.youtube.com cdn.jsdelivr.net msch.report-uri.com www.w3-edge.com *.freemius.com *.cm-wp.com www.rt22.ch cdn.rt22.ch rankmathapi.com www.google.com api.rankmath.com www.gstatic.com static.cloudflareinsights.com; object-src 'none';frame-src 'self' api-da97012a.duosecurity.com blackfire.io challenges.cloudflare.com www.google.com *.google.com *.wordpress.com *.wp.com *.twitter.com www.rt22.ch cdn.rt22.ch www.youtube.com www.w3-edge.com player.vimeo.com layerslider.com themeforest.net button.flattr.com flattr.com blob: div.show; worker-src 'self' www.rt22.ch cdn.rt22.ch blob: www.google.com; frame-ancestors 'self' www.goolge.com; form-action 'self' *.freemius.com www.rt22.ch cdn.rt22.ch search.google.com gtmetrix.com; media-src 'self' data: www.google.com twitter.com wa.me www.facebook.com layerslider.com; report-uri https://zhtz6kg8.uriports.com/reports/report; report-to default;
Directive Analysis
base-uriLOW
self
default-srcHIGH
self data: www.google.com twitter.com wa.me www.facebook.com
•CRITICAL: 'data:' URI in default-src allows arbitrary JavaScript execution
manifest-srcLOW
self
script-src-attrHIGH
unsafe-inline static.cloudflareinsights.com
•Unsafe inline execution allowed in script-src-attr
script-srcHIGH
unsafe-inline unsafe-eval blob: data: static.cloudflareinsights.com *.wp.com *.wordpress.com *.cm-wp.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.google.com *.gstatic.com api.w3-edge.com www.rt22.ch cdn.rt22.ch www.youtube.com cdn.jsdelivr.net kriesi.at connect.facebook.net platform.twitter.com player.vimeo.com cdn.syndication.twimg.com
•Unsafe inline execution allowed in script-src
•Unsafe eval() execution allowed in script-src
•HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobs
•CRITICAL: 'data:' URI in script-src allows arbitrary JavaScript execution
•Subdomain wildcard '*.wp.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wordpress.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.cm-wp.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.googleapis.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.googletagmanager.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.gstatic.com' in script-src - vulnerable to subdomain takeover
•HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src - Hosts npm packages including Angular which enables CSP bypass via JSONP
•No nonces or hashes used for script-src
⚠cdn.jsdelivr.net: Hosts npm packages including Angular which enables CSP bypass via JSONP
script-src-elemHIGH
self data: blob: unsafe-inline challenges.cloudflare.com app.formbricks.com gc.kis.v2.scr.kaspersky-labs.com *.cloudflare.com *.wp.com *.wordpress.com *.cm-wp.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.google.com *.gstatic.com api.w3-edge.com www.rt22.ch cdn.rt22.ch www.youtube.com cdn.jsdelivr.net kriesi.at connect.facebook.net platform.twitter.com player.vimeo.com cdn.syndication.twimg.com static.cloudflareinsights.com cdn.jquery.com
•CRITICAL: 'data:' URI in script-src-elem allows arbitrary JavaScript execution
•HIGH RISK: 'blob:' URI in script-src-elem allows script execution from dynamic blobs
•Unsafe inline execution allowed in script-src-elem
•Subdomain wildcard '*.cloudflare.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.wp.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.wordpress.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.cm-wp.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.google-analytics.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.googleapis.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.googletagmanager.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.google.com' in script-src-elem - vulnerable to subdomain takeover
•Subdomain wildcard '*.gstatic.com' in script-src-elem - vulnerable to subdomain takeover
•HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src-elem - Hosts npm packages including Angular which enables CSP bypass via JSONP
⚠cdn.jsdelivr.net: Hosts npm packages including Angular which enables CSP bypass via JSONP
style-srcHIGH
self data: unsafe-inline *.wp.com *.wordpress.com *.google.com *.gstatic.com *.googleapis.com www.rt22.ch cdn.rt22.ch cdn.jsdelivr.net cdn-images.mailchimp.com
•Info: 'data:' URI in style-src
•Unsafe inline execution allowed in style-src
•Subdomain wildcard '*.wp.com' in style-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wordpress.com' in style-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.gstatic.com' in style-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.googleapis.com' in style-src - vulnerable to subdomain takeover
img-srcHIGH
self data: blob: gtmetrix.com www.paypal.com previews.customer.envatousercontent.com repository.kreaturamedia.com *.google-analytics.com *.w.org *.wp.com *.cm-wp.com *.wordpress.com *.gravatar.com *.google.com *.gstatic.com *.googleapis.com *.freemius.com cdn.rt22.ch www.rt22.ch cdn.jsdelivr.net kriesi.at qr-code.ithemes.com www.paypalobjects.com image.thum.io layerslider.com
•Info: 'data:' URI in img-src
•Info: 'blob:' URI in img-src
•Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.w.org' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wp.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.cm-wp.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wordpress.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.gravatar.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.gstatic.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.googleapis.com' in img-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.freemius.com' in img-src - vulnerable to subdomain takeover
font-srcMEDIUM
self data: *.gstatic.com cdn.rt22.ch www.rt22.ch cdn.jsdelivr.net cdn.ss-cdn.com
•Info: 'data:' URI in font-src
•Subdomain wildcard '*.gstatic.com' in font-src - vulnerable to subdomain takeover
connect-srcHIGH
self *.wordpress.com app.formbricks.com *.wp.com *.w.org api.w3-edge.com maps.googleapis.com www.google-analytics.com www.youtube.com cdn.jsdelivr.net msch.report-uri.com www.w3-edge.com *.freemius.com *.cm-wp.com www.rt22.ch cdn.rt22.ch rankmathapi.com www.google.com api.rankmath.com www.gstatic.com static.cloudflareinsights.com
•Subdomain wildcard '*.wordpress.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wp.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.w.org' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.freemius.com' in connect-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.cm-wp.com' in connect-src - vulnerable to subdomain takeover
object-srcLOW
none
frame-srcHIGH
self api-da97012a.duosecurity.com blackfire.io challenges.cloudflare.com www.google.com *.google.com *.wordpress.com *.wp.com *.twitter.com www.rt22.ch cdn.rt22.ch www.youtube.com www.w3-edge.com player.vimeo.com layerslider.com themeforest.net button.flattr.com flattr.com blob: div.show
•Subdomain wildcard '*.google.com' in frame-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wordpress.com' in frame-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.wp.com' in frame-src - vulnerable to subdomain takeover
•Subdomain wildcard '*.twitter.com' in frame-src - vulnerable to subdomain takeover
•Info: 'blob:' URI in frame-src
worker-srcMEDIUM
self www.rt22.ch cdn.rt22.ch blob: www.google.com
•Info: 'blob:' URI in worker-src
•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob content
frame-ancestorsLOW
self www.goolge.com
form-actionMEDIUM
self *.freemius.com www.rt22.ch cdn.rt22.ch search.google.com gtmetrix.com
•Subdomain wildcard '*.freemius.com' in form-action - vulnerable to subdomain takeover
media-srcLOW
self data: www.google.com twitter.com wa.me www.facebook.com layerslider.com
•Info: 'data:' URI in media-src
report-uriLOW
https://zhtz6kg8.uriports.com/reports/report
•Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.
report-toLOW
default
Security Headers
✓Cross-Origin-Opener-PolicyPresent
cross-origin; report-to=default
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
✓Permissions-PolicyPresent
accelerometer=(self "https://www.youtube.com"), camera=(), geolocation=(), gyroscope=(self "https://www.youtube.com"), magnetometer=(), microphone=(), payment=(), usb=();report-to=default, fullscreen=*;report-to=default, payment=self;report-to=default
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
✓Referrer-PolicyPresent
same-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
✓Strict-Transport-SecurityPresent
max-age=31536000; includeSubDomains; preload
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
✓X-Content-Type-OptionsPresent
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
✓X-Frame-OptionsPresent
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
✓X-XSS-ProtectionPresent
1; mode=block
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
Issues Found
- •CRITICAL: 'data:' URI in default-src allows arbitrary JavaScript executioncritical
- •CRITICAL: 'data:' URI in script-src allows arbitrary JavaScript executioncritical
- •CRITICAL: 'data:' URI in script-src-elem allows arbitrary JavaScript executioncritical
- •Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.info
- •HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src - Hosts npm packages including Angular which enables CSP bypass via JSONPhigh
- •HIGH RISK CDN: 'cdn.jsdelivr.net' in script-src-elem - Hosts npm packages including Angular which enables CSP bypass via JSONPhigh
- •HIGH RISK: 'blob:' URI in script-src allows script execution from dynamic blobshigh
- •HIGH RISK: 'blob:' URI in script-src-elem allows script execution from dynamic blobshigh
- •Info: 'blob:' URI in frame-srcinfo
- •Info: 'blob:' URI in img-srcinfo
- •Info: 'blob:' URI in worker-srcinfo
- •Info: 'data:' URI in font-srcinfo
- •Info: 'data:' URI in img-srcinfo
- •Info: 'data:' URI in media-srcinfo
- •Info: 'data:' URI in style-srcinfo
- •No nonces or hashes used for script-srcmedium
- •RISK: 'blob:' in worker-src allows creation of workers from dynamic blob contentmedium
- •Subdomain wildcard '*.cloudflare.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.cm-wp.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.cm-wp.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.cm-wp.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.cm-wp.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.freemius.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.freemius.com' in form-action - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.freemius.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google-analytics.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google-analytics.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google-analytics.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.google.com' in style-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googleapis.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googleapis.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googleapis.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googleapis.com' in style-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googletagmanager.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.googletagmanager.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gravatar.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gstatic.com' in font-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gstatic.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gstatic.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gstatic.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.gstatic.com' in style-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.twitter.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.w.org' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.w.org' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wordpress.com' in style-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in connect-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in frame-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in img-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in script-src - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in script-src-elem - vulnerable to subdomain takeovermedium
- •Subdomain wildcard '*.wp.com' in style-src - vulnerable to subdomain takeovermedium
- •Unsafe eval() execution allowed in script-srchigh
- •Unsafe inline execution allowed in script-srchigh
- •Unsafe inline execution allowed in script-src-attrhigh
- •Unsafe inline execution allowed in script-src-elemhigh
- •Unsafe inline execution allowed in style-srchigh
Recommendations
- →Consider implementing a stricter Content Security Policy
- →Replace wildcards (*) with specific source lists
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
See what the internet sees about www.rt22.chWeak headers often come with other exposure — check the full picture.
See full exposure report on OSN →Free, no signup.
www.rt22.ch
4 scans since 8/1/2026
F
Latest: 38/100
Total Scans
4
Latest Score
38/100
First Scan
8/1/2026
Last Scan
8/1/2026
Security
38 / 100Significant security weaknesses detected in CSP configuration.
Compliance
100 / 100CSP implementation follows recommended standards and specifications.
Best Practices
67 / 100Basic practices followed but missing important optimizations.
Score Trend
Security score progression over 4 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
HTML
<a href="https://headertest.com/results/www.rt22.ch" title="Security headers grade for www.rt22.ch — HeaderTest">
<img src="https://headertest.com/api/badge/www.rt22.ch" alt="HeaderTest security grade: F (38/100) for www.rt22.ch" />
</a>Markdown
[](https://headertest.com/results/www.rt22.ch)