indexo.dev

sonnema.eu

.eu crawl

First seen 2026-06-02 · Last seen 2026-06-02 · ok HTTP/1.1 200 1520 ms crawled 2026-06-03

US · 99.83.234.29 · AS16509 Amazon.com, Inc.

Reputation 77/100 multiple spf records no dmarc policy

Classifying

HTML metadata

Title
Eigenzinnig Lekker - Sonnema since 1860
Language
en-US
Generator
WordPress 6.2.2
Canonical
https://sonnema.eu/

Open Graph

url
https://sonnema.eu/
title
Eigenzinnig Lekker - Sonnema since 1860
locale
en_US
site name
Sonnema since 1860

Technology

Server
nginx
CMS
WordPress 6.2.2

Third-party hosts loaded (1)

  • 23g-sharedhosting-sonnema.s3.eu-west-1.amazonaws.com×5

Social

Contact

Email
Phone
Address
SONNEMAStoombootkade 12, 8701 KA BolswardThe Netherlands

DNS records live

NS
  • ns1.dmg.nu
  • ns2.dmg.nu
MX
  • 0 hermanjansen-com.mail.protection.outlook.com

Email authentication weak

SPF
v=spf1 a mx ip4:195.72.122.181 ip4:31.160.140.169 ip4:86.92.98.145 ip4:45.82.191.173 ip6:2a0e:7280:0:191:173:777:0:1 include:_spf.elasticemail.com include:spf.messagelabs.com include:spf.protection.outlook.com -all
strict (-all) · multiple SPF records
DMARC
not published
DKIM
no key found at common selectors

Certificate (current)

Amazon RSA 2048 M01
from 2025-11-03 to 2026-12-03
Expires in 180 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://sonnema.eu/

present
  • strict-transport-security
  • content-security-policy
  • x-frame-options
  • x-content-type-options
  • referrer-policy
  • permissions-policy
findings
  • CSP allows unsafe inline scripts/styles
  • CSP uses wildcard sources
Header values
referrer-policy
same-origin
x-frame-options
SAMEORIGIN
permissions-policy
accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), battery=(), camera=(), clipboard-read=(), clipboard-write=(), conversion-measurement=(), cross-origin-isolated=(), direct-sockets=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), focus-without-user-activation=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-autofill=(), speaker-selection=(), storage-access-api=(), sync-script=(), sync-xhr=(), trust-token-redemption=(), usb=(), vertical-scroll=(), wake-lock=(), web-share=(), window-placement=(), xr-spatial-tracking=()
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' *.tidiochat.com;img-src 'self' 'unsafe-inline' s.w.org *.amazonaws.com *.facebook.com *.facebook.net *.reddit.com *.gravatar.com *.google.com *.google.nl *.hsforms.com *.hubspot.com *.google-analytics.com *.googletagmanager.com *.vimeocdn.com *.ytimg.com *.linkedin.com data:;style-src 'self' 'unsafe-inline' *.typeform.com *.googleapis.com;font-src 'self' 'unsafe-inline' *.gstatic.com data:;frame-src 'self' 'unsafe-inline' *.facebook.com *.typeform.com *.google.com *.youtube.com *.vimeo.com *.hsappstatic.net *.hubspot.com *.buzzsprout.com;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.facebook.net *.redditstatic.com *.hsadspixel.net *.buzzsprout.com *.typeform.com *.google.com *.google-analytics.com *.23g.io *.licdn.com *.googletagmanager.com *.gstatic.com *.youtube.com *.vimeo.com *.hs-scripts.com *.hscollectedforms.net *.hs-banner.com *.hsforms.net *.hs-analytics.net *.hsforms.com *.googleadservices.com *.doubleclick.net https://stat
strict-transport-security
max-age=31536000; includeSubDomains

Links to (2)

Linked from (1)