centivo.com

HTML metadata

Title

Self-Funded Health Plans for Employers | Centivo

Description

Primary-care-centered self-funded health plans for employers of 50–3,000. Save ~15-30% vs. fully-insured. Serving WI, TX, FL, NY, WA, CT, PA, NC and more.

Language

en

Canonical

https://centivo.com/

Feeds

Centivo » Home Comments Feed RSS

Open Graph

url: https://centivo.com/
title: Self-Funded Health Plans for Employers | Centivo
locale: en_US
site name: Centivo
description: Primary-care-centered self-funded health plans for employers of 50–3,000. Save ~15-30% vs. fully-insured. Serving WI, TX, FL, NY, WA, CT, PA, NC and more.
updated time: 2026-03-17T14:36:43-04:00

Technology

CDN: Cloudflare
CMS: WordPress

Analytics

Google Tag Manager

Fonts

Adobe Fonts

Third-party hosts loaded (3)

use.typekit.net×4
js.hsforms.net×1
www.googletagmanager.com×1

Social

Contact

Email

Address

199 Scott Street, 14204, Buffalo, NY, US

Registration

Registrar

Squarespace Domains II LLC

Created

2004-03-06

Expires

2027-03-06 291 days left

Updated

2026-02-19

Name servers

ns-1284.awsdns-32.org
ns-1844.awsdns-38.co.uk
ns-216.awsdns-27.com
ns-897.awsdns-48.net

DNS records live

NS

ns-1284.awsdns-32.org
ns-1844.awsdns-38.co.uk
ns-216.awsdns-27.com
ns-897.awsdns-48.net

MX

10 centivo-com.mx1.arsmtp.com
20 centivo-com.mx2.arsmtp.com

TXT

Show 7 TXT records

anthropic-domain-verification-f62a1e=EwjrogCcz54uCZQAQfSmHPQoN
atlassian-domain-verification=oK4haAudoAlIhUr925/0yHDbaxd/gZhkyr0REFDti2wccS3yiN0s1yokICC7JsVu
google-site-verification=hpRu2RlJKzJMU0Q3y8o8K2oIWU2ZQkhhcrO8bvg2RSw
include:spf.us-east-1.amazonses.com -all"
MS=ms12927303
"v=spf1 include:spf.edgepilot.com include:spf.protection.outlook.com include:centivo-com.spf.smtp25.com include:spf.zixsmbhosted.com include:app.sgizmo.com include:5084039.spf10.hubspotemail.net include:mailgun.org
_spf.salesforce.com ~all

Email authentication weak

SPF

not published

DMARC

v=DMARC1; p=none;

policy: none (monitoring only)

DKIM

s1: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/8ZkD10LqEBZtTpusUWUBtCfsT3pkAcnE+n0P9mFIwCXb0/k2XkC56pnGXYGICnNDmqzTlswiOp7qxuuKK6xUjT…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOIqyHbED5ndkHh0aX8KCYO1mJpghnCd2tMcQeZTTa0YkUBtdo9CFByOU88n1NbofGB3vJmHlwi0t2ieVPtGrleY…

selectors probed

Certificate (current)

E7

from 2026-04-20 to 2026-07-19

Expires in 62 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://centivo.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy
cross-origin-opener-policy
cross-origin-embedder-policy
cross-origin-resource-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
permissions-policy: camera=(), microphone=(), geolocation=()
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://jobs.ashbyhq.com https://*.googletagmanager.com https://*.google-analytics.com https://googleads.g.doubleclick.net https://*.googleadservices.com https://*.hubspot.com https://*.hsforms.com https://*.hsforms.net https://*.hs-scripts.com https://*.hs-analytics.net https://*.hs-banner.com https://*.hscollectedforms.net https://js.hsadspixel.net https://js.hsleadflows.net https://js.usemessages.com https://*.google.com https://*.gstatic.com https://connect.facebook.net https://snap.licdn.com https://nexus.ensighten.com https://*.adroll.com https://bat.bing.com https://cdn.cookielaw.org https://cdn.segment.com https://cdn.branch.io https://*.salesforceliveagent.com https://static.ads-twitter.com https://tr.snapchat.com https://www.redditstatic.com; style-src 'self' 'unsafe-inline' https://use.typekit.net https://p.typekit.net https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' https://use.typekit.net https
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy: unsafe-none
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin