careoregon.org

HTML metadata

Title: CareOregon - Home
Description: Whether you’re a current Oregon Health Plan (OHP) Medicaid member or want to become one, CareOregon is here to help you get the best health care.
Language: en
Generator: Sitefinity 15.2.8426.0 DX
Canonical: https://www.careoregon.org

Open Graph

url: https://www.careoregon.org
title: CareOregon - Home
site name: Default
description: Whether you’re a current Oregon Health Plan (OHP) Medicaid member or want to become one, CareOregon is here to help you get the best health care.

Technology

Server: Microsoft-IIS

Analytics

Google Tag Manager

Fonts

Adobe Fonts

Third-party hosts loaded (4)

cdn.jsdelivr.net×2
ajax.googleapis.com×1
use.typekit.net×1
www.googletagmanager.com×1

Social

Contact

Phone

Registration

Registrar

GoDaddy.com, LLC

Created

1998-10-20

Expires

2026-10-19 151 days left

Updated

2025-12-15

Name servers

pdns09.domaincontrol.com
pdns10.domaincontrol.com

DNS records live

NS

pdns09.domaincontrol.com
pdns10.domaincontrol.com

MX

0 careoregon-org.mail.protection.outlook.com

TXT

Show 15 TXT records

96vramp0q9kpiiqlf9ss4o5g48
ao6iqvo1t33i3mprvmfpqo5qvq
intacct-esk=4FED1A45805FFD1DE0539B06A8C0D298
f9r6cbv4ag8dq578uud9fs7kgg
4688p3v0jr5fbd41shjb5eaqrv
cvfb9fs8vgfdu46a8prr10c2qa
T9fVWpOOyzZFw9jsz79LUk/8/xS8y8EKGfMWeUwz4rpdWOT35cOrxkxQh3pGBFTKHBDgqcyz2B59ALpgd5iaBg==
mve34320kvf0be5b809tvrjjoj
jg6rhv51fbrhn5or3j2ikb3be9
7o4bcs8k1sdge540lo8grtqrbt
6k3og3j231r5b3bom979iibvjg
eiadj3kdcith04f76ddibc885f
abl3on7vbkonmntucgiarn4q9o
intersight=8426abc5a2b780ad737411e5631be6bd06641e2d1c9743f5b78745b3a99efdcf
kguk54tlqh4ttcffsvgr34u575

Verified for

Adobe
Apple
Figma
Google
Microsoft 365
Zoom

Email authentication strong

SPF

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:servers.mcsv.net include:e2ma.net include:spf.workfront.com include:healthwise.net include:_spf.intacct.com ip4:148.66.226.0/24 ip4:209.94.86.0/24 ip4:81.93.173.201 ip4:81.93.164.103 ip4:208.185.235.0/24 ip4:148.59.108.0/23 ip4:148.59.106.0/23 ip4:209.2.137.186 ip4:204.246.133.164 ip4:204.246.133.170 ip4:216.38.221.173 ip4:35.80.141.6 ip4:44.229.121.55 ip4:148.59.100.16/28 -all

strict (-all)

DMARC

v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email;

policy: reject (enforced)

DKIM

selector1: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIuRF5REy7ksxUian4uILCs1usfXViQlZx0NbMdg1X9wd9j1l0hwA41ZqciWUR9zlPY2LfPhaxtjHwf0d5F+…
selector2: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCr0KSTNGj/LIpxQZeXSTh9VyfbWcfpmEhEDE9aUbBYUg1i5WBBGUrzkyq1rHIBfGa9p5PTXeihaIP…
k2: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA…

selectors probed

Certificate (current)

Go Daddy Secure Certificate Authority - G2

from 2025-05-02 to 2026-06-02

Expires in 13 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://careoregon.org/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy
cross-origin-opener-policy
cross-origin-embedder-policy
cross-origin-resource-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self)
x-content-type-options: nosniff
content-security-policy: default-src 'self' translate-pa.googleapis.com https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0 cdnjs.cloudflare.com api.brightedge.com dev-iis-app-01.careoregon.org *.audioeye.com anlalytics.audioeye.com forms.housecallproviders.org wsv3cdn.audioeye-services.com; script-src 'self' *.googleapis.com *.gstatic.com www.google.com apis.google.com *.google-analytics.com connect.facebook.net ajax.aspnetcdn.com https://www.youtube.com platform.twitter.com https://syndication.twitter.com/ https://s.ytimg.com https://publish.twitter.com *.twimg.com platform.linkedin.com http://platform.stumbleupon.com/1/widgets.js https://*.googletagmanager.com cdnjs.cloudflare.com translate.google.com/translate_a/element.js 'unsafe-inline' 'unsafe-eval' https://cdn.insight.sitefinity.com https://dec.azureedge.net/ munchkin.marketo.net *.eloqua.com js.hs-scripts.com js.hs-analytics.net *.en25.com cdn.ampproject.org web-chat.nativechat.com code.jquery.com ajax.googleapis.com https
strict-transport-security: max-age=31536000
cross-origin-opener-policy: unsafe-none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin