content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self' data: https://*.gouv.fr https://openmaptiles.github.io ; font-src 'self' https://cdn.jsdelivr.net; img-src 'self' data: https://*.gouv.fr; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.gouv.fr blob:; style-src 'self' 'unsafe-inline';

Diagnostics

Metrics

http

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

Detect websites using AWS bucket storage

Detect websites using AWS cloudfront service

AWS Cloudfront service detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

Detect if AWS is being used in the application.

AWS Service - Detect

Detect Amazon-S3 Bucket

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

_pk_ses.277.9ac4

_pk_id.277.9ac4

Websites that have a shopping cart or checkout page, either using a known ecommerce platform or a custom solution.

Cart Functionality

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

TypeScript is an open-source language which builds on JavaScript  by adding static type definitions.

TypeScript

PHP is a general-purpose scripting language used for web development.

Zone.js

Angular is a TypeScript-based open-source web application framework led by the Angular Team at Google.

Angular

Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.

Amazon Web Services

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.

Amazon S3

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.

Amazon CloudFront

AWS Certificate Manager is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources.

AWS Certificate Manager

Webpack is an open-source JavaScript module bundler.

Webpack

Progressive Web Apps (PWAs) are web apps built and enhanced with modern APIs to deliver enhanced capabilities, reliability, and installability while reaching anyone, anywhere, on any device, all with a single codebase.

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

name	domain	httpOnly	secure
_pk_ses.277.9ac4	cartographie.societenumerique.gouv.fr	❌	❌
_pk_id.277.9ac4	cartographie.societenumerique.gouv.fr	❌	❌

type	url	details
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
jsdelivr	cdn.jsdelivr.net/npm/@gou...	Host files locally
unknown	openmaptiles.github.io/os...
unknown	openmaptiles.github.io/os...

flag	country	hostname	ip	city
	États Unis	cartographie.societenumerique.gouv.fr	18.160.225.13	?
	?	cdn.jsdelivr.net	104.18.187.31	?
	États Unis	openmaptiles.github.io	185.199.108.153	?

https://cartographie.societenumerique.gouv.fr

LightHouse

https://cartographie.societenumerique.gouv.fr/environ 4 heures

Eco-index

GES: 1.94 gramme(s) par visite

Eau : 2.91 cl par visite

Ça veut dire quoi ?

Cookiesenviron 4 heures

Scripts tiersenviron 4 heures

Déclaration de mise en accessibilité

Conformité partielle