bflcanada.ca

HTML metadata

Title: Commercial insurance solutions/risk management planning | BFL CANADA
Description: BFL CANADA: Leader in global risk management and insurance brokerage, providing clients with custom industry-specific coverage solutions.
Language: en
Canonical: https://www.bflcanada.ca/

Open Graph

url: https://www.bflcanada.ca/
title: Commercial insurance solutions/risk management planning | BFL CANADA
description: BFL CANADA: Leader in global risk management and insurance brokerage, providing clients with custom industry-specific coverage solutions.

Technology

Server: Sucuri
CMS: Nuxt

Analytics

Google Tag Manager

Third-party hosts loaded (6)

www.bflcanada.ca×36
res.cloudinary.com×9
cdn-cookieyes.com×1
stackpath.bootstrapcdn.com×1
www.facebook.com×1
www.googletagmanager.com×1

Social

Registration

Registrar

Webnames.ca Inc.

Created

2003-06-09

Expires

2026-06-09 21 days left

Updated

2026-04-24

Name servers

ns1.webnames.ca
ns2.webnames.ca
ns3.webnames.ca

DNS records live

NS

ns1.webnames.ca
ns2.webnames.ca
ns3.webnames.ca

MX

10 bflcanada-ca.mail.protection.outlook.com

TXT

Show 8 TXT records

v=spf1 include:servers.mcsv.net include:spf-00302201.pphosted.com include:mailgun.org include:_spf.ultipro.com include:spf.protection.outlook.com ~all
facebook-domain-verification=i0oaq2d8z5tdl41v5qvv1kuqy1mo1u
google-site-verification=sl0uDYgxbigVP7vthiQNNyAgClRF1A9yf8XPvZEJC1Q
sr15qgdt3jaf47j33tuvio4uc
apple-domain-verification=zKmd8kIdkMAPHrKj
druide-validation-domaine=66bc7735565b1e17170ce6d2aec677da
ZOOM_verify_h50vXoVuSBeUPmHH6e2ARQ
cisco-ci-domain-verification=3f35d5121359b02d7ce8e286a164a4372c012f47590551dfae007acd57ca2ae

Certificate (current)

Starfield Secure Certificate Authority - G2

from 2026-05-11 to 2026-08-09

Expires in 83 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.bflcanada.ca/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
weak frame protection
weak content type protection

Header values

referrer-policy: strict-origin-when-cross-origin, no-referrer-when-downgrade
x-frame-options: SAMEORIGIN, SAMEORIGIN
permissions-policy: autoplay=(self)
x-content-type-options: nosniff, nosniff
content-security-policy: upgrade-insecure-requests;, default-src 'self' api.test-bfl-stg.com test-bfl-stg.com www.test-bfl-stg.com www.googletagmanager.com www.bflcanada.ca api.bflcanada.ca www.google.com www.gstatic.com *.amazonaws.com www.google-analytics.com acsbapp.com *.acsbapp.com accounts.accessibe.com player.vimeo.com www.recaptcha.net; style-src api.test-bfl-stg.com www.test-bfl-stg.com test-bfl-stg.com https://www.bflcanada.ca https://*.myfonts.net https://*.bootstrapcdn.com 'unsafe-inline'; img-src www.googletagmanager.com api.test-bfl-stg.com test-bfl-stg.com www.test-bfl-stg.com https://www.bflcanada.ca https://api.bflcanada.ca https://www.google-analytics.com https://www.facebook.com https://acsbapp.com https://cdn.acsbapp.com https://web1.acsbapp.com https://accounts.accessibe.com https://res.cloudinary.com https://cdn-cookieyes.com data:; connect-src 'self' api.test-bfl-stg.com test-bfl-stg.com www.test-bfl-stg.com https://www.bflcanada.ca https://api.bflcanada.ca https://www.google.com https:/
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains; preload