neocities.org

.org toplist crawl

First seen 2026-04-11 · Last seen 2026-05-19 · ok HTTP/1.1 200 555 ms crawled 2026-05-18

US · 23.143.32.6 · AS395409 Neocities

Reputation 100/100

Classifying

HTML metadata

Title: Neocities: Create your own free website!
Description: Create and surf awesome websites for free.
Language: en
Canonical: https://neocities.org/

Open Graph

title: Neocities
description: Create and surf awesome websites for free.

Technology

Server: neocities

Third-party hosts loaded (1)

hcaptcha.com×1

Social

Registration

Registrar

NameCheap, Inc.

Created

2013-05-24

Expires

2033-05-24 2561 days left

Updated

2023-08-26

Name servers

ns1.neocities.org
ns2.neocities.org

DNS records live

NS

ns1.neocities.org
ns2.neocities.org

MX

10 mail.protonmail.ch
20 mailsec.protonmail.ch

TXT

protonmail-verification=238c06187344e93995b50f60aeb9e9ea6915d25c

Email authentication strong

SPF: v=spf1 include:amazonses.com include:spf.improvmx.com include:_spf.protonmail.ch -all
strict (-all)
DMARC: v=DMARC1; p=reject; aspf=s; adkim=s;
policy: reject (enforced)
DKIM: no key found at common selectors

Certificate (current)

R13

from 2026-05-04 to 2026-08-02

Expires in 75 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://neocities.org/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: DENY
x-content-type-options: nosniff
content-security-policy: default-src 'self' data: blob: 'unsafe-inline'; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.stripe.com; frame-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://js.stripe.com
strict-transport-security: max-age=63072000; includeSubDomains; preload