content-security-policy

Content Security Policy (CSP) implemented with unsafe sources inside style-src. This includes 'unsafe-inline', data: or overly broad sources such as https:.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is visible via cross-origin resource sharing (CORS) files or headers, but is restricted to specific domains

public-key-pinning

HTTP Public Key Pinning (HPKP) header not implemented

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) is implemented and all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

X-XSS-Protection header not needed due to strong Content Security Policy (CSP) header

base-uri 'none'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'nonce-QKZ6B8kUcPaf7w5HlOnyPQ=='; upgrade-insecure-requests

Diagnostics

Metrics

http

https

base-uri 'none'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'nonce-jSpq2rlZ4ZKX6eMeDRjaiQ=='; upgrade-insecure-requests

Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.

Sentry

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Nuxt is a Vue framework for developing modern web applications.

Nuxt.js

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

https://monsuivisocial.incubateur.anct.gouv.fr

LightHouse

https://monsuivisocial.incubateur.anct.gouv.fr/

Eco-index

GES: 1.94 gramme(s) par visite

Eau : 2.91 cl par visite

Ça veut dire quoi ?

Third parties

Page de statistiques

Déclaration de mise en accessibilité