hostelworld.com

HTML metadata

Title

Hostels Worldwide - Online Bookings, Ratings and Reviews

Description

Online confirmed bookings for backpacker hostels around the world. City guides, sightseeing, entertainment and backpacking information for hostels and backpacker tours around the world.

Language

en

Canonical

https://www.hostelworld.com/

Translations

pt ×2
cs
da
de
en
es
fi
fr
it
ja
ko
nl
no
pl
ru
sv
tr
zh

Open Graph

url: https://www.hostelworld.com/
title: Hostels Worldwide - Online Bookings, Ratings and Reviews
site name: Hostelworld
description: Online confirmed bookings for backpacker hostels around the world. City guides, sightseeing, entertainment and backpacking information for hostels and backpacker tours around the world.

Technology

Server: Google
CMS: Nuxt

Analytics

Google Tag Manager
Segment

Cookie consent

TrustArc

Fonts

Google Fonts

Third-party hosts loaded (9)

a.hwstatic.com×55
sc.hwstatic.com×21
u.hwstatic.com×4
consent.trustarc.com×2
www.googletagmanager.com×2
analytics.ahrefs.com×1
cdn.segment.com×1
fonts.gstatic.com×1
i.hwstatic.com×1

Social

Registration

Registrar

EuroDNS S.A.

Created

1999-05-12

Expires

2027-05-12 356 days left

Updated

2026-05-06

Name servers

ns-cloud-d1.googledomains.com
ns-cloud-d2.googledomains.com
ns-cloud-d3.googledomains.com
ns-cloud-d4.googledomains.com

DNS records live

NS

ns-cloud-d1.googledomains.com
ns-cloud-d2.googledomains.com
ns-cloud-d3.googledomains.com
ns-cloud-d4.googledomains.com

MX

10 hostelworld-com.mail.protection.outlook.com

TXT

Show 8 TXT records

prodpad-domain-verification=olgjmVfkM78L70FSMaq7qFjNxVFh5qxQluiXTlrPpd8=
astro-domain-verification=cmgtbeqtb054701n12ek3jnjj
jamf-site-verification=zIkmP441dR4tQVNZClcIzg
notion_verify_BghXBaFhLWJE43VLeqR14w7BKzCZzmVmjd2CNqf5FrYRMjsemrw3LrQhRUzc8VuiZaA054
taegis-domain-verification=14f69ca8f6a3c83b1e185b4dfc21ed80d340a890cd2d9a399925dba370c8acf2
ov1pMr2zZRYYIYkpdRN1dhj/S09OKvJIx/apcBwaUKw=
<21.08.2024>
FteeyUdpsHOGx017vM9LxJ+0wIbZA1/0Pa2g/GteWcA=

Verified for

Adobe
Apple
Atlassian
Cursor
Figma
GlobalSign
Google
MongoDB
Stripe

Email authentication strong

SPF

v=spf1 mx a:smtp.europe.secureserver.net include:spfip.hostelworld.com include:mail.zendesk.com include:spf.protection.outlook.com include:servers.mcsv.net ?include:trustpilotservice.com include:spf.byway.it -all

strict (-all)

DMARC

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc_agg@vali.email

policy: quarantine · sp=quarantine

DKIM

selector1: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWph0+lFD+PgjH0dFyZLsRM5LNomzy+PGYPM14l5Crlz/mXNZENN0BrzyXW9as4cfnTKJWMJcdM4bHmZ+TSH…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2fWSi1HglUUxJaJA5AeVfbEYx4mkN+DGi45QVspQzW9Kft39HFn27vmosVcFAIOhe5VaiCk0DBQuL7ZZbn…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDELtfFUFE2GlExbukbaa3WGc9culmQ6f5mO0Tj8+n8SAmJUcGltxaLKcRqiyebmuD0yumAw1w3Js4DEkUD0c2od5…

selectors probed

Certificate (current)

GlobalSign ECC OV SSL CA 2018

from 2025-11-17 to 2026-12-19

Expires in 213 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://www.hostelworld.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
cross-origin-opener-policy
cross-origin-resource-policy

findings

missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: base-uri none; font-src self https: data:; form-action self; frame-ancestors self; object-src none; upgrade-insecure-requests; frame-src self https://www.googletagmanager.com/ https://gum.criteo.com/ https://dynamic.criteo.com/ https://fledge.criteo.com/ https://fledge.us.criteo.com/ https://api.mapbox.com/ https://www.youtube.com/ https://consent.trustarc.com https://consent-pref.trustarc.com https://cdn.segment.com/ https://web.btncdn.com/ https://analytics.ahrefs.com/ https://www.facebook.com/ https://pay.datatrans.com/ https://pay.sandbox.datatrans.com/;
strict-transport-security: max-age=15552000; includeSubDomains
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin