content-security-policy

Content Security Policy (CSP) implemented with unsafe sources inside style-src. This includes 'unsafe-inline', data: or overly broad sources such as https:.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is visible via cross-origin resource sharing (CORS) files or headers, but is restricted to specific domains

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) is implemented and all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "0" (disabled)

base-uri 'none'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'nonce-VsRHYnqV7Fk00/iq3wgnHQ=='; upgrade-insecure-requests; connect-src 'self' https://api-adresse.data.gouv.fr https://geo.api.gouv.fr https://matomo.dev.incubateur.anct.gouv.fr https://matomo.incubateur.anct.gouv.fr https://sentry.incubateur.net;

http

https

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

File similar to robots.txt but intended to be read by humans wishing to contact a website’s owner about security issues. Often defines a security policy and contact details.


security.txt File

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

base-uri 'none'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'nonce-J7KKXiLsDnPmaHtXSq+Gdw=='; upgrade-insecure-requests; connect-src 'self' https://api-adresse.data.gouv.fr https://geo.api.gouv.fr https://matomo.dev.incubateur.anct.gouv.fr https://matomo.incubateur.anct.gouv.fr https://sentry.incubateur.net;

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Nuxt is a Vue framework for developing modern web applications.

Nuxt.js

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Progressive Web Apps (PWAs) are web apps built and enhanced with modern APIs to deliver enhanced capabilities, reliability, and installability while reaching anyone, anywhere, on any device, all with a single codebase.

flag	country	hostname	ip	city
	France	monsuivisocial.incubateur.anct.gouv.fr	51.158.59.9	Paris

https://monsuivisocial.incubateur.anct.gouv.fr

Eco-index

GES: 1.84 gramme(s) par visite

Eau : 2.76 cl par visite

Ça veut dire quoi ?

Cookiesenviron 3 heures

Scripts tiersenviron 3 heures