ppf.co.uk

HTML metadata

Title: Welcome to the PPF | Pension Protection Fund
Description: It's our duty to protect people with a defined benefit pension when an employer becomes insolvent.
Language: en

Open Graph

title: Welcome to the PPF
description: It's our duty to protect people with a defined benefit pension when an employer becomes insolvent. We manage £39 billion of assets for our 295,000 members.

Technology

CDN: Cloudflare

Analytics

Google Tag Manager

Fonts

Adobe Fonts

Third-party hosts loaded (4)

cdnjs.cloudflare.com×10
cookie-cdn.cookiepro.com×1
use.typekit.net×1
www.googletagmanager.com×1

Social

Registration

Registrar

123-Reg Limited t/a 123-reg

Created

2015-11-27

Expires

2027-11-27 555 days left

Updated

2024-08-17

Name servers

lynn.ns.cloudflare.com.
sofia.ns.cloudflare.com.

DNS records live

NS

lynn.ns.cloudflare.com
sofia.ns.cloudflare.com

MX

10 eu-smtp-inbound-1.mimecast.com
10 eu-smtp-inbound-2.mimecast.com

TXT

mindmanager-verification=b3ef1763c68f5fcb719f09306f7b3bdeb43d1c9c43b09854f9bc8a99d55d9e20
mszcfngqsvj4ssds69g33p6v7y3g9kxl

Verified for

Google

Email authentication strong

SPF: v=spf1 ip4:20.90.233.221 ip4:51.141.24.136 include:spf-uk.emailsignatures365.com include:spf.protection.outlook.com include:eu._netblocks.mimecast.com -all
strict (-all)
DMARC: v=DMARC1; p=reject; rua=mailto:dmarc-rua@ppf.co.uk,mailto:YTdWoZNKKPh@dmarc-rua.mailcheck.service.ncsc.gov.uk; ruf=mailto:dmarc-ruf@ppf.co.uk; fo=1; sp=none;
policy: reject (enforced) · sp=none
DKIM: no key found at common selectors

Certificate (current)

DigiCert Global G2 TLS RSA SHA256 2020 CA1

from 2025-07-04 to 2026-08-05

Expires in 76 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 95/100 Checked live page: https://www.ppf.co.uk/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=()
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdnjs.cloudflare.com cookie-cdn.cookiepro.com www.googletagmanager.com www.recaptcha.net; script-src-elem 'self' 'unsafe-inline' cdnjs.cloudflare.com cookie-cdn.cookiepro.com www.gstatic.com www.recaptcha.net gc.kis.v2.scr.kaspersky-labs.com me.kis.v2.scr.kaspersky-labs.com www.googletagmanager.com; script-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com fonts.googleapis.com p.typekit.net use.typekit.net; style-src-elem 'self' 'unsafe-inline' cdnjs.cloudflare.com use.typekit.net p.typekit.net fonts.googleapis.com me.kis.v2.scr.kaspersky-labs.com; style-src-attr 'unsafe-inline'; img-src 'self' data: ppf.co.uk cookie-cdn.cookiepro.com i.ytimg.com region1.google-analytics.com www.googletagmanager.com; font-src 'self' data: use.typekit.net ka-f.fontawesome.com https://fonts.gstatic.com https://fonts.googleapis.com; connec
strict-transport-security: max-age=31536000; includeSubDomains; preload