https://www.lalsweets.com/

Scan ID:
19ef63b6-bac1-4556-bff0-bcf011005472Finished
Submitted URL:
https://lalsweets.com/Redirected
Report Finished:

Risks · 0 found

Copy link

Practices that may pose security risks

  • No classification

Security Headers · 6 found

Copy link

HTTP response headers that can harden the security of a web application

Learn more...
NameValueSupportInfo
Strict-Transport-Securitymax-age=7889238GoodDeclare that a website is only accessible over a secure connection (HTTPS).

Click to learn more...
X-Frame-OptionsDENYGoodIndicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>.

Click to learn more...
X-Content-Type-OptionsnosniffGoodIndicate that the MIME types advertised in the Content-Type headers should be followed and not be changed.

Click to learn more...
Content-Security-Policyblock-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; GoodControl resources the user agent is allowed to load for a given page.

Click to learn more...
Referrer-Policy—GoodControl how much referrer information should be included with requests.

Click to learn more...
Clear-Site-Data—GoodControl the data stored by a client browser for their origins.

Click to learn more...
X-Permitted-Cross-Domain-PoliciesnoneGoodControl whether a web client such as Adobe Flash Player or Adobe Acrobat has permission to handle data across domains.

Click to learn more...
Permissions-Policy—NewAllow and deny the use of browser features in a document or iframe.

Click to learn more...
Cross-Origin-Embedder-Policy—NewConfigure embedding cross-origin resources into the document.

Click to learn more...
Cross-Origin-Opener-Policy—NewEnsure a top-level document does not share a browsing context group with cross-origin documents.

Click to learn more...
Cross-Origin-Resource-Policy—NewRequest that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Click to learn more...
X-XSS-Protection1; mode=blockDeprecatedDeprecated. Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.

Click to learn more...
Feature-Policy—DeprecatedDeprecated. Replaced by the Permissions-Policy header.

Click to learn more...
Expect-CT—DeprecatedDeprecated. Opt in to reporting and/or enforcement of Certificate Transparency requirements.

Click to learn more...
Public-Key-Pins—DeprecatedDeprecated. Allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates.

Click to learn more...

Security Violations · 4 found

Copy link

Requests or resources offending security policies

ViolationTypeInfo
Description
Failed parsing 'srcset' attribute value since its 'w' descriptor is invalid.
certificatecertificate
Description
Failed parsing 'srcset' attribute value since its 'w' descriptor is invalid.
certificatecertificate
Description
Failed parsing 'srcset' attribute value since its 'w' descriptor is invalid.
certificatecertificate
Resource
https://cdn.shopify.com/extensions/be44c97b-a558-4773-94ab-21e35a5909de/0.0.0/assets/air-reviews-main.min.js?v=1736923400223
Description
-- Invalid review pops
certificatecertificate

Certificates · 20 found

Copy link

SSL/TLS Certificates enable websites to encrypt transactions between the client and the server and provide server identity verification

SubjectIssue dateExpiry date
www.lalsweets.comDec 16, 2024, 04:34:13Mar 16, 2025, 05:33:59
*.jquery.comJun 25, 2024, 00:00:00Jun 25, 2025, 23:59:59
cdnjs.cloudflare.comNov 26, 2024, 07:25:18Feb 24, 2025, 07:25:17
*.google-analytics.comDec 9, 2024, 08:36:18Mar 3, 2025, 08:36:17
cdn.shopify.comDec 25, 2024, 12:52:03Mar 25, 2025, 13:51:59
ecomposer.appJan 14, 2025, 05:19:33Apr 14, 2025, 06:19:06
www.google.comDec 9, 2024, 08:38:06Mar 3, 2025, 08:38:05
*.facebook.comOct 24, 2024, 00:00:00Jan 22, 2025, 23:59:59
*.g.doubleclick.netDec 9, 2024, 08:36:17Mar 3, 2025, 08:36:16
*.google.esDec 9, 2024, 08:38:52Mar 3, 2025, 08:38:51