luzi-type.ch
HTML metadata
Technology
- Server
- Apache
DNS records live
- NS
-
- ns-anycast1.hostpoint.ch
- ns-anycast2.hostpoint.ch
- ns-ch.hostpoint.ch
Email authentication strong
- SPF
-
v=spf1 redirect=spf.mail.hostpoint.chmissing all - DMARC
-
v=DMARC1; p=quarantine;policy: quarantine - DKIM
- no key found at common selectors
Certificates
Loading certificate
HTTP security headers
- present
-
- strict-transport-security
- content-security-policy
- x-frame-options
- x-content-type-options
- referrer-policy
- permissions-policy
- cross-origin-opener-policy
- cross-origin-resource-policy
- findings
-
- CSP allows unsafe inline scripts/styles
- CSP uses wildcard sources
Header values
- referrer-policy
strict-origin-when-cross-origin- x-frame-options
SAMEORIGIN- permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(*), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()- x-content-type-options
nosniff- content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com; style-src 'self' 'unsafe-inline' https://luzi-type.ch; img-src 'self' data: https://*.stripe.com https://*.stripecdn.com https://m.stripe.network; font-src 'self' https://luzi-type.ch data:; connect-src 'self' https://luzi-type.ch https://api.stripe.com https://stripe.com https://*.stripe.com https://m.stripe.network; frame-src 'self' https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com https://stripe.com https://m.stripe.network; frame-ancestors 'self' https://*.stripe.com; object-src 'none'; base-uri 'self'- strict-transport-security
max-age=31536000; includeSubDomains; preload- cross-origin-opener-policy
same-origin-allow-popups- cross-origin-resource-policy
same-site