indexo.dev

wellbeingworksbetter.org

.org crawl

First seen 2026-04-11 · Last seen 2026-05-18 · ok HTTP/1.1 200 1898 ms crawled 2026-05-18

US · 104.18.24.231 · AS13335 Cloudflare, Inc.

Reputation 100/100

Classifying

HTML metadata

Title
Well-being Works Better
Description
Our Well-being Works Better platform helps business leaders promote health and well-being for all. Building a culture where employees thrive is no longer an option. It’s a business imperative.
Language
en
Canonical
https://www.wellbeingworksbetter.org/en/

Open Graph

url
https://www.wellbeingworksbetter.org/en/
title
American Heart Association Well-being Works Better
site name
wellbeingworksbetter.org
description
Our Well-being Works Better platform helps business leaders promote health and well-being for all. Building a culture where employees thrive is no longer an option. It’s a business imperative.

Technology

CDN
Cloudflare
Analytics
  • Cloudflare Insights
  • Google Tag Manager
Cookie consent
  • OneTrust

Third-party hosts loaded (5)

  • static.cloud.coveo.com×6
  • static.heart.org×2
  • cdn.cookielaw.org×1
  • static.cloudflareinsights.com×1
  • www.googletagmanager.com×1

Contact

Phone

Registration

Registrar
MarkMonitor Inc.
Created
2024-04-22
Expires
2027-04-22 337 days left
Updated
2026-03-26
Name servers
  • ns1.heart.org
  • ns2.heart.org
  • ns3.heart.org

DNS records live

NS
  • ns1.heart.org
  • ns2.heart.org
  • ns3.heart.org
TXT
  • google-site-verification=LGmXksJq2tpaDLEHMkMUp2dYCAtoXmTbNkHQcuoJylY

Email authentication no MX

SPF
not published
DMARC
v=DMARC1;p=reject;sp=reject;fo=1;rua=mailto:dmarc_rua@emaildefense.proofpoint.com;ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
policy: reject (enforced) · sp=reject
DKIM
no key found at common selectors

Certificate (current)

WE1
from 2026-03-22 to 2026-06-20
Expires in 31 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 50/100 Checked live page: https://www.wellbeingworksbetter.org/

present
  • content-security-policy
  • x-frame-options
findings
  • missing HSTS
  • CSP allows unsafe inline scripts/styles
  • CSP uses wildcard sources
  • missing content type protection
  • missing Referrer Policy
  • missing Permissions Policy
Header values
x-frame-options
SAMEORIGIN
content-security-policy
default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googleoptimize.com https://*.cookielaw.org https://*.cloud.coveo.com https://*.googletagmanager.com https://*.fundraiseup.com https://*.google-analytics.com https://*.hotjar.com https://*.facebook.net https://*.quantserve.com https://*.adsrvr.org https://*.vimeocdn.com https://*.pixel.ad https://*.pardot.com https://*.optimizely.com https://*.doubleclick.net https://*.googleadservices.com https://*.sascdn.com https://*.id5-sync.com https://*.licdn.com https://*.ads-twitter.com https://*.googlesyndication.com *; style-src 'self' 'unsafe-inline' *; connect-src 'self' 'unsafe-inline' *; font-src 'self' data: *; img-src 'self' data: *; frame-src 'self' *; media-src 'self' blob: data: *

Links to (1)

Linked from (1)