https://paypalbtcinc.invoicely.com/invoice/08b75da9bcbb42319a75aea2a914af97

Scan ID:
1ea39ae6-41f1-4ec1-b84f-68e36cb99d93Finished
Submitted URL:
https://paypalbtcinc.invoicely.com/invoice/08b75da9bcbb42319a75aea2a914af97
Report Finished:

Risks · 0 found

Practices that may pose security risks

  • No classification

Security Headers · 6 found

HTTP response headers that can harden the security of a web application

Learn more...
NameValueSupportInfo
Strict-Transport-Securitymax-age=63072000; includeSubDomains; preloadGoodDeclare that a website is only accessible over a secure connection (HTTPS).

Click to learn more...
X-Frame-OptionsDENYGoodIndicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>.

Click to learn more...
X-Content-Type-OptionsnosniffGoodIndicate that the MIME types advertised in the Content-Type headers should be followed and not be changed.

Click to learn more...
Content-Security-Policy—GoodControl resources the user agent is allowed to load for a given page.

Click to learn more...
Referrer-Policystrict-origin-when-cross-originGoodControl how much referrer information should be included with requests.

Click to learn more...
Clear-Site-Data—GoodControl the data stored by a client browser for their origins.

Click to learn more...
X-Permitted-Cross-Domain-Policies—GoodControl whether a web client such as Adobe Flash Player or Adobe Acrobat has permission to handle data across domains.

Click to learn more...
Permissions-Policy—NewAllow and deny the use of browser features in a document or iframe.

Click to learn more...
Cross-Origin-Embedder-Policy—NewConfigure embedding cross-origin resources into the document.

Click to learn more...
Cross-Origin-Opener-Policy—NewEnsure a top-level document does not share a browsing context group with cross-origin documents.

Click to learn more...
Cross-Origin-Resource-Policy—NewRequest that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Click to learn more...
X-XSS-Protection1; mode=blockDeprecatedDeprecated. Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.

Click to learn more...
Feature-Policygeolocation 'self'; midi 'none'; sync-xhr 'self'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'; DeprecatedDeprecated. Replaced by the Permissions-Policy header.

Click to learn more...
Expect-CT—DeprecatedDeprecated. Opt in to reporting and/or enforcement of Certificate Transparency requirements.

Click to learn more...
Public-Key-Pins—DeprecatedDeprecated. Allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates.

Click to learn more...

Security Violations · 1 found

Requests or resources offending security policies

ViolationTypeInfo
Resource
https://static.zdassets.com/web_widget/classic/latest/web-widget-chat-sdk-9195154.js
Description
Refused to connect to 'wss://widget-mediator.zopim.com/s/W/ws/W9V1TnYtD3e--hTH/c/1727929886265' because it violates the following Content Security Policy directive: "connect-src 'self' 'self' https://*.zendesk.com https://*.ingest.sentry.io https://*.zdassets.com https://www.google.com https://www.google-analytics.com https://www.gstatic.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://*.stripe.com https://cdn.rawgit.com https://eversign.com https://invoicely.com https://*.invoicely.com https://invoicely.com https://invoicely-api.invoicely.com".
Content Security PolicyControl resources the user agent is allowed to load for a given page.

Click to learn more...

Certificates · 7 found

SSL/TLS Certificates enable websites to encrypt transactions between the client and the server and provide server identity verification

SubjectIssue dateExpiry date
invoicely.comSep 7, 2024, 00:00:00Oct 7, 2025, 23:59:59
a.stripecdn.comAug 29, 2024, 00:00:00Dec 5, 2024, 23:59:59
zdassets.comSep 5, 2024, 13:35:12Dec 4, 2024, 14:35:10
*.s3.amazonaws.comApr 22, 2024, 00:00:00Apr 7, 2025, 23:59:59
www.google.comAug 26, 2024, 07:15:49Nov 18, 2024, 07:15:48
*.gstatic.comAug 26, 2024, 07:12:45Nov 18, 2024, 07:12:44
invoicely.zendesk.comOct 1, 2024, 08:34:41Dec 30, 2024, 08:34:40