- Scan ID:
- feb3f12f-bb3a-4221-a93c-b304134f699bFinished
- Submitted URL:
- https://supersa.sa.gov.au/Redirected
- Report Finished:
Risks · 0 found
Copy linkPractices that may pose security risks
Security Headers · 5 found
Copy linkHTTP response headers that can harden the security of a web application
Learn more...| Name | Value | Support | Info |
|---|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | Good | Declare that a website is only accessible over a secure connection (HTTPS). Click to learn more... |
| X-Frame-Options | sameorigin | Good | Indicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Click to learn more... |
| X-Content-Type-Options | nosniff | Good | Indicate that the MIME types advertised in the Content-Type headers should be followed and not be changed. Click to learn more... |
| Content-Security-Policy | default-src 'self'; child-src https://www.recaptcha.net https://td.doubleclick.net https://supersa.lifetimesupermodeller.com.au https://www.surveymonkey.com https://*.g.doubleclick.net https://*.google.com https://*.youtube.com https://*.vimeo.com https://supersa.gbsau.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://apps.mypurecloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://www.recaptcha.net https://apps.mypurecloud.com.au https://az416426.vo.msecnd.net https://heatmaps.monsido.com https://app-script.monsido.com https://ajax.googleapis.com https://www.googletagmanager.com https://widget.surveymonkey.com https://*.gstatic.com https://*.episerver.net https://*.google.com https://*.google-analytics.com https://cdnjs.cloudflare.com https://*.vimeocdn.com; img-src 'self' https://www.googletagmanager.com https://prod.smassets.net https://www.google-analytics.com https://tracking.monsido.com https://*.google.com https://*.google.com.au data:; connect-src 'self' wss://streaming.mypurecloud.com.au https://api.mypurecloud.com.au https://dc.services.visualstudio.com https://www.google-analytics.com https://analytics.google.com https://*.g.doubleclick.net https://heatmaps.monsido.com; font-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com https://apps.mypurecloud.com; | Good | Control resources the user agent is allowed to load for a given page. Click to learn more... |
| Referrer-Policy | — | Good | Control how much referrer information should be included with requests. Click to learn more... |
| Clear-Site-Data | — | Good | Control the data stored by a client browser for their origins. Click to learn more... |
| X-Permitted-Cross-Domain-Policies | — | Good | Control whether a web client such as Adobe Flash Player or Adobe Acrobat has permission to handle data across domains. Click to learn more... |
| Permissions-Policy | — | New | Allow and deny the use of browser features in a document or iframe. Click to learn more... |
| Cross-Origin-Embedder-Policy | — | New | Configure embedding cross-origin resources into the document. Click to learn more... |
| Cross-Origin-Opener-Policy | — | New | Ensure a top-level document does not share a browsing context group with cross-origin documents. Click to learn more... |
| Cross-Origin-Resource-Policy | — | New | Request that the browser blocks no-cors cross-origin/cross-site requests to the given resource. Click to learn more... |
| X-XSS-Protection | 1 1 | Deprecated | Deprecated. Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Click to learn more... |
| Feature-Policy | — | Deprecated | Deprecated. Replaced by the Permissions-Policy header. Click to learn more... |
| Expect-CT | — | Deprecated | Deprecated. Opt in to reporting and/or enforcement of Certificate Transparency requirements. Click to learn more... |
| Public-Key-Pins | — | Deprecated | Deprecated. Allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates. Click to learn more... |
Security Violations · 3 found
Copy linkRequests or resources offending security policies
| Violation | Type | Info |
|---|---|---|
| Content Security Policy | Controls resources the user agent is allowed to load for a given page. Click to learn more... |
| Content Security Policy | Controls resources the user agent is allowed to load for a given page. Click to learn more... |
| Content Security Policy | Controls resources the user agent is allowed to load for a given page. Click to learn more... |
Certificates · 11 found
Copy linkSSL/TLS Certificates enable websites to encrypt transactions between the client and the server and provide server identity verification
| Subject | Issue date | Expiry date |
|---|---|---|
| www.supersa.sa.gov.au | ||
| cdnjs.cloudflare.com | ||
| dl.episerver.net | ||
| app-script.monsido.com | ||
| *.vimeo.com | ||
| *.google-analytics.com | ||
| az416426.vo.msecnd.net | ||
| *.g.doubleclick.net | ||
| heatmaps.monsido.com | ||
| tracking.monsido.com |