novoed.com

HTML metadata

Title: Talent Development Platform — NovoEd
Description: Built by training leaders, the NovoEd talent development platform harnesses industry expertise to empower your organization to achieve measurable results.
Language: en-US
Generator: WordPress 6.9.4
Canonical: https://novoed.com/

Open Graph

url: https://novoed.com/
title: Homepage
locale: en_US
site name: NovoEd

Technology

Server: nginx
CMS: WordPress

Analytics

Google Tag Manager

Fonts

Google Fonts

Third-party hosts loaded (7)

cdn-app.pathfactory.com×2
api-gateway.scriptintel.io×1
fonts.gstatic.com×1
gmpg.org×1
j.6sc.co×1
js.hsforms.net×1
www.googletagmanager.com×1

Social

Contact

Address: st course invitations and learning events.hbspt.forms.create({ portalId: "55936

Registration

Registrar

GoDaddy.com, LLC

Created

2012-08-03

Expires

2028-08-03 806 days left

Updated

2023-07-10

Name servers

ns-1498.awsdns-59.org
ns-1897.awsdns-45.co.uk
ns-250.awsdns-31.com
ns-530.awsdns-02.net

DNS records live

NS

ns-1498.awsdns-59.org
ns-1897.awsdns-45.co.uk
ns-250.awsdns-31.com
ns-530.awsdns-02.net

MX

1 aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

TXT

Show 4 TXT records

atlassian-domain-verification=zknb6SdLH/8PliqfLmtzbV0pWr/iYLPYIcBBV13HtvN6MEwa33sE4ioAomLEaoTj
facebook-domain-verification=2a0his9mue1m0wka6w0k9z0twrs3vc
google-site-verification=PJLQc6qtFf9Zql_eWw_OOR6KnaOx4TBSOPuLBZnTyZo
_0192x7ok9punjbsg86fpix5347hg68m

Email authentication strong

SPF

v=spf1 include:_spf.google.com include:sendgrid.net include:559363.spf10.hubspotemail.net include:spf.mandrillapp.com include:_spf.salesforce.com ~all

softfail (~all)

DMARC

v=DMARC1; p=quarantine; fo=1;

policy: quarantine

DKIM

Show 4 DKIM selectors

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArzahL8JaPrixdBbsAVbGMSeUeq7Nr+gBETLFjBNBceKMUNLrFDiIkCLnYrF8r23lz7JesHwig13s/r…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtk6xW3wyHEFD0bKsDYlOK2KSD89uyaYmUUVMHItimiuaugxX8IxRUB1A38wLvK172UOv9x4TniGeW8rQer…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI8QHmEY0oi+E/2gLDedabd+27PV9w1vou8atPKugol+5wv1hj54h7hJPt5JMCrt0vcuGoOCfAOz78KF8TigS/SH…
smtpapi: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76…

selectors probed

Certificate (current)

R12

from 2026-04-20 to 2026-07-19

Expires in 61 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://novoed.com/

present

strict-transport-security
content-security-policy
content-security-policy-report-only
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
permissions-policy: camera=(), fullscreen=(self), geolocation=(), microphone=()
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: j.6sc.co js.hsforms.net connect.facebook.net; script-src-elem 'self' 'unsafe-inline' blob: js.storylane.io tags.clickagy.com wss://ws.hotjar.com static.addtoany.com googleads.g.doubleclick.net https://js.zi-scripts.com *.hotjar.com js.hubspot.com js.hs-banner.com js.hs-analytics.net *.adroll.com js.hs-scripts.com static.hotjar.com static.ads-twitter.com *.google-analytics.com snap.licdn.com connect.facebook.net a.usbrowserspeed.com api-gateway.scriptintel.io cdn-app.pathfactory.com j.6sc.co js.hsforms.net *.googletagmanager.com; script-src-attr 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; style-src-elem 'self' 'unsafe-inline' https: blob:; img-src 'self' https: data:; connect-src 'self' blob: aorta.clickagy.com wss://ws.hotjar.com d.adroll.com js.hs-banner.com c.6sc.co ws.zoominfo.com js.zi-scripts.com https://spcollector.pathfactory.com https://cdn-app.path
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy-report-only: default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report