indexo.dev

empoweredtoserve.org

.org crawl

First seen 2026-04-11 · Last seen 2026-05-18 · ok HTTP/1.1 200 2337 ms crawled 2026-05-18

US · 104.18.29.53 · AS13335 Cloudflare, Inc.

Reputation 95/100 weak security headers

Classifying

HTML metadata

Title
EmPOWERED to Serve | American Heart Association
Description
Provides the support communities need to change the future of health, economic mobility, and opportunity.
Language
en
Canonical
https://www.empoweredtoserve.org/en/

Open Graph

url
https://www.empoweredtoserve.org/en/
title
Em<span class="text-uppercase">powered</span> to Serve&trade;
site name
www.empoweredtoserve.org
description
Provides the support communities need to change the future of health, economic mobility, and opportunity.

Technology

CDN
Cloudflare
Analytics
  • Cloudflare Insights
  • Google Tag Manager
Cookie consent
  • OneTrust
Fonts
  • Google Fonts
Third-party hosts loaded (8)
  • static.cloud.coveo.com×6
  • fonts.googleapis.com×2
  • static.heart.org×2
  • cdn.cookielaw.org×1
  • cdn.jsdelivr.net×1
  • fonts.gstatic.com×1
  • static.cloudflareinsights.com×1
  • www.googletagmanager.com×1

Social

Contact

Phone

Registration

Registrar
MarkMonitor Inc.
Created
2013-06-29
Expires
2026-06-29 39 days left
Updated
2025-06-02
Name servers
  • ns1.heart.org
  • ns2.heart.org
  • ns3.heart.org

DNS records live

NS
  • ns1.heart.org
  • ns2.heart.org
  • ns3.heart.org
MX
  • 0 smtp.secureserver.net
  • 10 mailstore1.secureserver.net
Verified for
  • Meta

Email authentication strong

SPF
not published
DMARC
v=DMARC1;p=reject;sp=reject;fo=1;rua=mailto:dmarc_rua@emaildefense.proofpoint.com;ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
policy: reject (enforced) · sp=reject
DKIM
no key found at common selectors

Certificate (current)

WE1
from 2026-03-29 to 2026-06-28
Expires in 38 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 40/100 Checked live page: https://www.empoweredtoserve.org/

present
  • content-security-policy
findings
  • missing HSTS
  • CSP allows unsafe inline scripts/styles
  • CSP uses wildcard sources
  • missing frame protection
  • missing content type protection
  • missing Referrer Policy
  • missing Permissions Policy
Header values
content-security-policy
default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googleoptimize.com https://*.cookielaw.org https://*.cloud.coveo.com https://*.googletagmanager.com https://*.fundraiseup.com https://*.google-analytics.com https://*.hotjar.com https://*.facebook.net https://*.quantserve.com https://*.adsrvr.org https://*.vimeocdn.com https://*.pixel.ad https://*.pardot.com https://*.optimizely.com https://*.doubleclick.net https://*.googleadservices.com https://*.sascdn.com https://*.id5-sync.com https://*.licdn.com https://*.ads-twitter.com https://*.googlesyndication.com *; style-src 'self' 'unsafe-inline' *; connect-src 'self' 'unsafe-inline' *; font-src 'self' data: *; img-src 'self' data: *; frame-src 'self' *; media-src 'self' blob: data: *

Links to (15)

Linked from (1)