puzzle-itc.de
HTML metadata
Technology
- Server
- nginx
- CMS
- WordPress
Third-party hosts loaded (2)
- www.puzzle.ch×10
- s3.amazonaws.com×1
Social
Contact
- Phone
Registration
- Updated
- 2021-01-12
- Name servers
-
- helium.ns.hetzner.de.
- hydrogen.ns.hetzner.com.
- oxygen.ns.hetzner.com.
DNS records live
- NS
-
- helium.ns.hetzner.de
- hydrogen.ns.hetzner.com
- oxygen.ns.hetzner.com
- MX
-
- 1 aspmx.l.google.com
- 10 alt3.aspmx.l.google.com
- 10 alt4.aspmx.l.google.com
- 5 alt1.aspmx.l.google.com
- 5 alt2.aspmx.l.google.com
- TXT
-
MS=ms43439489bw=NKXxAY3esRXGF0SYfsDM935ioBQ4EpUDx9RZeEzqtP43google-site-verification=9eXnqKE-wItv-RhbNfjJ8h-ENDKzbUENskQ5yaP3ut4
Email authentication weak
- SPF
-
v=spf1 include:_spf.google.com ~allsoftfail (~all) - DMARC
- not published
- DKIM
-
- google:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdcNcD+Ybi3Uhc0YXHNABrva9NuM4FE2/KKsGLJBohqOeN3dBhdKRxIah0aa/8CspMRReGxIfb1mgUlUzkFY…
selectors probed - google:
Certificate (current)
E7
Expires in 68 days
HTTP security headers
- present
-
- strict-transport-security
- content-security-policy
- x-frame-options
- x-content-type-options
- referrer-policy
- permissions-policy
- findings
-
- CSP allows unsafe inline scripts/styles
- CSP uses wildcard sources
Header values
- referrer-policy
strict-origin-when-cross-origin, no-referrer-when-downgrade- x-frame-options
SAMEORIGIN- permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(self), battery=(), camera=(self), display-capture=(self), document-domain=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(self), midi=(), payment=(), picture-in-picture=(self), usb=(), web-share=(self)- x-content-type-options
nosniff- content-security-policy
default-src *; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://s3.amazonaws.com https://matomo.puzzle.ch https://maps.googleapis.com https://www.google.com https://www.gstatic.com https://fonts.googleapis.com https://www.youtube.com https://puzzle.us13.list-manage.com https://yoast.com; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' https: data:; font-src 'self' https: data: https://fonts.gstatic.com- strict-transport-security
max-age=31536000; includeSubDomains