umbraco.com

HTML metadata

Title: Umbraco CMS - the flexible open-source .NET CMS
Description: Umbraco is the leading open-source ASP.NET Core CMS | More than 700,000 websites worldwide are powered by our flexible and editor-friendly CMS
Language: en-US
Canonical: https://umbraco.com/

Open Graph

url: https://umbraco.com/
title: Umbraco CMS - the flexible open-source .NET CMS
description: Umbraco is the leading open-source ASP.NET Core CMS | More than 700,000 websites worldwide are powered by our flexible and editor-friendly CMS

Technology

CDN: Cloudflare

Fonts

Google Fonts

Third-party hosts loaded (1)

fonts.gstatic.com×2

Social

Contact

Address: Buchwaldsgade 35, 2. sal, 5000, Odense, DK

Registration

Registrar

Cloudflare, Inc.

Created

2003-09-23

Expires

2026-09-23 127 days left

Updated

2025-08-24

Name servers

davina.ns.cloudflare.com
roan.ns.cloudflare.com

DNS records live

NS

davina.ns.cloudflare.com
roan.ns.cloudflare.com

MX

1 aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

TXT

Show 6 TXT records

anthropic-domain-verification-22jj8c=n4f4GDY2bhy2EpaE0qBJ0ifV2
apple-domain-verification=o3MbQ62rpEfSmlFK
facebook-domain-verification=oflwcmlwu5jxowkj9hnukj40pvmj9e
google-site-verification=97vLCVebmXZh4wHcRI7mkKy6rayRisdaglFGzi-zPhU
status-page-domain-verification=276d3sk1v8q9
MS=ms52615003

Email authentication strong

SPF

v=spf1 include:_u.umbraco.com._spf.smart.ondmarc.com ~all

softfail (~all)

DMARC

v=DMARC1; p=quarantine; pct=100; sp=quarantine; rua=mailto:ec958dec@inbox.ondmarc.com; ruf=mailto:ec958dec@inbox.ondmarc.com; adkim=r; aspf=r; fo=1; rf=afrf; ri=3600

policy: quarantine · sp=quarantine

DKIM

Show 4 DKIM selectors

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtZdOHABOabuoYOiOvntMOdK0oem4jKmp0dpxMFFsOrUuxYUCxzyizyJJu6Pr5VCTii4ymX+c4pJMJX…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyNA/lflyyItu1j2ydTJiaIbqWnDblVGUnSOpCij9XlNDS1UpNXyy2vAovhqjhMUjvCd0aD44G2YvmaEZ9n…
s2: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7O8RjPhNB/5bShp6JG2KoC8ZKssQ1KjqRQOVNFHMVRSRNlAlwnSV835vgniuxV+pBFKjaDY61oRQwcU0oF…
smtpapi: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76…

selectors probed

Certificate (current)

WE1

from 2026-05-15 to 2026-08-13

Expires in 86 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://umbraco.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self "https://capture.navattic.com"), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=(self)
x-content-type-options: nosniff
content-security-policy: default-src 'self' googleads.g.doubeclick.net play.google.com;script-src 'self' ajax.aspnetcdn.com *.calendly.com www.google.com maps.googleapis.com *.googleapis.com *.gstatic.com *.g2.com *.g2crowd.com recruit.hr-on.com umbracohq.matomo.cloud consent.cookiebot.com consentcdn.cookiebot.com tagmanager.google.com *.googletagmanager.com load.sst.umbraco.com *.load.sst.umbraco.com cdn.matomo.cloud connect.facebook.net *.app-us1.com trackcmp.net *.fluentos.com *.doubleclick.net app.intercom.io widget.intercom.io js.intercomcdn.com blob: 'nonce-fdQNZx7JmnOQSIu+Z6wc29BT0Ftf9Bvq213VmZLoRMI=';style-src 'self' fonts.googleapis.com *.calendly.com tagmanager.google.com blob: 'unsafe-inline';connect-src 'self' blob: data: maps.gstatic.com maps.googleapis.com mapsresources-pa.googleapis.com *.googletagmanager.com *.analytics.google.com *.google-analytics.com consentcdn.cookiebot.com www.google.com px.ads.linkedin.com sst.umbraco.com umbracohq.matomo.cloud *.doubleclick.net *.navattic.com *.fluentos.
strict-transport-security: max-age=31536000; includeSubDomains; preload