thorntontomasetti.com

HTML metadata

Title: Thornton Tomasetti | When others say no, we say "Here's How"
Description: We apply engineering and scientific principles to solve the world’s challenges—starting with yours.
Language: en
Generator: Drupal 10 (https://www.drupal.org)
Canonical: https://www.thorntontomasetti.com/

Open Graph

title: Thornton Tomasetti
image:url: https://www.thorntontomasetti.com/sites/default/files/2024-09/tt-master.png
description: We apply scientific and engineering principles to solve the world’s challenges — starting with yours.

Technology

Server: nginx
CMS: Drupal

Analytics

Google Tag Manager

Third-party hosts loaded (3)

extend.vimeocdn.com×1
maps.googleapis.com×1
www.googletagmanager.com×1

Social

Contact

Phone

18779939737

Registration

Registrar

GoDaddy.com, LLC

Created

2004-03-05

Expires

2030-09-20 1584 days left

Updated

2023-11-30

Name servers

ns1.thorntontomasetti.com
ns2.thorntontomasetti.com

DNS records live

NS

ns1.thorntontomasetti.com
ns2.thorntontomasetti.com

MX

10 mxa-005b9802.gslb.pphosted.com
10 mxb-005b9802.gslb.pphosted.com

TXT

57d5c976109a6006efa866d37568a46a25619c0a

Verified for

Adobe
Microsoft 365
Miro
MongoDB

Email authentication strong

SPF

v=spf1 ip4:64.157.153.144 ip4:12.151.76.6 ip4:148.139.3.2 ip4:167.89.11.197 include:spf.protection.outlook.com include:spf-005b9802.pphosted.com mx -all

strict (-all)

DMARC

v=DMARC1;p=quarantine;rua=mailto:dmarc@thorntontomasetti.com

policy: quarantine

DKIM

selector1: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAywbNzAtzQCPYeHTVvd834ngwjapLdYG49shmzegMRyOo3VKl6Oieqf6fUutsFymEhcAQtUt0H8UraZ…
selector2: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc7H8WwH/0A/6iw4JRtQl+ClEbRO8qH1vOILZ9ud27ll2QzPQKRTJ2E94G6eRrNFX9rDMqTzg/cMx37Pu3ak…
k2: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA…

selectors probed

Certificate (current)

R12

from 2026-05-03 to 2026-08-01

Expires in 73 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.thorntontomasetti.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

short HSTS max-age
CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: default-src 'self'; child-src 'self' https://maps.googleapis.com https://maps.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://www.google.com https://www.gstatic.com https://extend.vimeocdn.com https://player.vimeo.com/ https://static.hotjar.com https://script.hotjar.com https://app.enzuzo.com https://sc.lfeeder.com https://googleads.g.doubleclick.net https://www.podbean.com; connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://www.google.com https://stats.g.doubleclick.net https://googleads.g.doubleclick.net https://app.enzuzo.com https://*.enzuzo.com https://cs.lf-discover.com https://sc.lfeeder.com https://*.hotjar.com https://*.hotjar.io https://maps.googleapis.com https://maps.gstatic.com https://*.googleapis.com https://pagead2.googlesyndication.com; font-src 'self' data: https://fonts.gstatic.com; frame-src 'self' https://www.youtube.com https://www.google.com https://www.go
strict-transport-security: max-age=1000, max-age=300