ceenema.eu
HTML metadata
Technology
- Server
- Apache
- jQuery
- 3.4.1 known XSS (<3.5)
- Stack
- PHP, Django
- Fonts
-
- Google Fonts
Third-party hosts loaded (3)
- fonts.googleapis.com×2
- fonts.gstatic.com×1
- maps.googleapis.com×1
Social
Contact
- Address
- Uraniastraße 1, 1010, Wien, DE
DNS records live
- NS
-
- ns1.world4you.at
- ns2.world4you.at
- MX
-
- 10 mail.ceenema.eu
Email authentication partial
- SPF
-
v=spf1 mx include:spf.w4ymail.at -allstrict (-all) - DMARC
-
v=DMARC1;p=none;policy: none (monitoring only) - DKIM
- no key found at common selectors
Certificate (current)
E7
Expires in 59 days
HTTP security headers
- present
-
- strict-transport-security
- content-security-policy
- x-frame-options
- x-content-type-options
- findings
-
- short HSTS max-age
- CSP allows unsafe inline scripts/styles
- CSP uses wildcard sources
- weak frame protection
- missing Referrer Policy
- missing Permissions Policy
Header values
- x-frame-options
sameorigin, SAMEORIGIN- x-content-type-options
nosniff- content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://*.googletagmanager.com https://www.googleadservices.com https://www.google.com https://pagead2.googlesyndication.com https://maps.googleapis.com https://googleads.g.doubleclick.net https://*.google-analytics.com 'self' https://*.googleapis.com https://*.gstatic.com *.google.com https://*.ggpht.com *.googleusercontent.com blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com 'self'; img-src 'self' data: blob: https://www.google.com https://www.google.pl 'self' https://*.googleapis.com https://*.gstatic.com *.google.com *.googleusercontent.com https://i.ytimg.com https://img.youtube.com; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' wss://socket.abdeo.pl https://www.google.com https://*.google-analytics.com https://www.google.pl/ 'self' https://*.googleapis.com *.google.com https://*.gstatic.com data: blob:; media-src 'self' ; frame-src 'self' *.google.com https://ww- strict-transport-security
max-age=300; includeSubDomains; preload