https://www.ifs.com/

扫描 ID：
001cf01a-98ca-4cfb-a4bc-fab2f0874056已完成
提交的 URL：
https://ifs.com/已重定向
报告完成时间：

风险 · 找到 0 个

可能带来安全风险的做法

  • 无分类

安全标头 · 找到 5 个

可以增强 Web 应用程序安全性的 HTTP 响应标头

了解更多...
名称值支持信息
Strict-Transport-Securitymax-age=31536000; includeSubDomains; preload良性声明只能通过安全连接 (HTTPS) 访问网站。

单击可了解更多信息...
X-Frame-OptionsSAMEORIGIN良性表明是否允许浏览器在 <frame>、<iframe>、<embed> 或 <object> 中渲染页面。

单击可了解更多信息...
X-Content-Type-Optionsnosniff良性表明应该遵循 Content-Type 标头中公布的 MIME 类型，并且不得进行更改。

单击可了解更多信息...
Content-Security-Policydefault-src 'self' data: blob: *.ifs.com *.justgiving.com *.searchstax.com *.twitter.com *.ads-twitter.com *.facebook.net https://*.onetrust.com https://*.sonobi.com https://*.spotxchange.com https://*.addthis.com https://*.socdm.com https://*.fout.jp https://*.stickyadstv.com https://*.adtdp.com *.litix.io *.demandbase.com *.wistia.com *.wistia.net embedwistia-a.akamaihd.net *.google-analytics.com www.googletagmanager.com *.googleadservices.com *.googleoptimize.com *.googleapis.com *.gstatic.com *.cloudflare.com *.leadforensics.com linkedin.oribi.io *.oribi.io *.t.co *.google.lk *.smartrecruiters.com *.mathtag.com *.doubleclick.net pixel.tapad.com *.marketo.com *.marketo.net *.linkedin.com *.krxd.net p.adsymptotic.com *.comparesoft.com tracking.g2crowd.com tr.apsislead.com static.oktopost.com tags.bkrtx.com snap.licdn.com *.rlcdn.com *.hotjar.com *.hotjar.io *.yahoo.com https://*.openx.net https://*.casalemedia.com https://*.bidswitch.net *.vendemore.com careers-p2energysolutions.icims.com https://*.adingo.jp *.clarity.ms www.facebook.com *.okt.to okt.to *.bluekai.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com siteimproveanalytics.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com aa.agkn.com y.one.impact-ad.jp wss://*.hotjar.com https://*.adnxs.com https://*.pubmatic.com https://*.adsrvr.org https://*.adform.net https://*.shinobi.jp https://*.smaato.net https://*.semasio.net *.akstat.io *.akamaihd.net *.go-mpulse.net *.adsrvr.org marketing.ultimo.com *.mplat-ppcprotect.com *.o11.tech *.sentry-cdn.com *.mktoweb.com *.jquery.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.inzynk.io *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.vg *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat *.company-target.com *.marketo.com *.adoberesources.net *.adobe.com *.typekit.net *.adobe.io wss://*.adobe.io *.googleusercontent.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' fast.wistia.com info.ifs.com; frame-src 'self' *.smartrecruiters.com *.o11.tech *.adsrvr.org marketing.ultimo.com *.company-target.com *.marketo.com careers-p2energysolutions.icims.com www.facebook.com info.ifs.com *.wistia.net *.hotjar.com *.bluekai.com *.doubleclick.net *.wistia.com *.adobe.com *.googletagmanager.com; 良性控制允许用户代理为指定页面加载的资源。

单击可了解更多信息...
Referrer-Policy—良性控制请求中应该包含多少引荐者信息。

单击可了解更多信息...
Clear-Site-Data—良性控制客户端浏览器为来源服务器存储的数据。

单击可了解更多信息...
X-Permitted-Cross-Domain-Policies—良性控制 Web 客户端（例如 Adobe Flash Player 或 Adobe Acrobat）是否拥有跨域处理数据的权限。

单击可了解更多信息...
Permissions-Policy—新允许和拒绝在文档或 iframe 中使用浏览器功能。

单击可了解更多信息...
Cross-Origin-Embedder-Policy—新配置将跨源资源嵌入到文档中。

单击可了解更多信息...
Cross-Origin-Opener-Policy—新确保顶级文档不与跨源文档共享浏览背景组。

单击可了解更多信息...
Cross-Origin-Resource-Policy—新请求浏览器阻止对给定资源的 no-cors 跨源/跨站点请求。

单击可了解更多信息...
X-XSS-Protection1; mode=block停用已弃用。当检测到页面遭受反射式跨站点脚本 (XSS) 攻击时，停止加载页面。

单击可了解更多信息...
Feature-Policy—停用已弃用。替换为 Permissions-Policy 标头。

单击可了解更多信息...
Expect-CT—停用已弃用。选择加入报告和/或执行证书透明度要求。

单击可了解更多信息...
Public-Key-Pins—停用已弃用。允许 HTTPS 网站抵御攻击者使用错误颁发的或其他欺诈性证书进行假冒。

单击可了解更多信息...

安全违规行为 · 找到 2 个

违反安全策略的请求或资源

违规类型信息
资源
https://www.googletagmanager.com/gtm.js?id=GTM-MQBJ2JS
描述
Refused to connect to 'https://pagead2.googlesyndication.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.ifs.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1625435692.1734018599&navt=n&npa=1&gtm=45He4cb0v857466672za200&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734018598541&tfd=5712&apve=1' because it violates the following Content Security Policy directive: "default-src 'self' data: blob: *.ifs.com *.justgiving.com *.searchstax.com *.twitter.com *.ads-twitter.com *.facebook.net https://*.onetrust.com https://*.sonobi.com https://*.spotxchange.com https://*.addthis.com https://*.socdm.com https://*.fout.jp https://*.stickyadstv.com https://*.adtdp.com *.litix.io *.demandbase.com *.wistia.com *.wistia.net embedwistia-a.akamaihd.net *.google-analytics.com www.googletagmanager.com *.googleadservices.com *.googleoptimize.com *.googleapis.com *.gstatic.com *.cloudflare.com *.leadforensics.com linkedin.oribi.io *.oribi.io *.t.co *.google.lk *.smartrecruiters.com *.mathtag.com *.doubleclick.net pixel.tapad.com *.marketo.com *.marketo.net *.linkedin.com *.krxd.net p.adsymptotic.com *.comparesoft.com tracking.g2crowd.com tr.apsislead.com static.oktopost.com tags.bkrtx.com snap.licdn.com *.rlcdn.com *.hotjar.com *.hotjar.io *.yahoo.com https://*.openx.net https://*.casalemedia.com https://*.bidswitch.net *.vendemore.com careers-p2energysolutions.icims.com https://*.adingo.jp *.clarity.ms www.facebook.com *.okt.to okt.to *.bluekai.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com siteimproveanalytics.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com aa.agkn.com y.one.impact-ad.jp wss://*.hotjar.com https://*.adnxs.com https://*.pubmatic.com https://*.adsrvr.org https://*.adform.net https://*.shinobi.jp https://*.smaato.net https://*.semasio.net *.akstat.io *.akamaihd.net *.go-mpulse.net *.adsrvr.org marketing.ultimo.com *.mplat-ppcprotect.com *.o11.tech *.sentry-cdn.com *.mktoweb.com *.jquery.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.inzynk.io *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.vg *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat *.company-target.com *.marketo.com *.adoberesources.net *.adobe.com *.typekit.net *.adobe.io wss://*.adobe.io *.googleusercontent.com 'unsafe-inline' 'unsafe-eval'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
内容安全策略控制允许用户代理为指定页面加载的资源。

单击可了解更多信息...
资源
https://www.ifs.com/
描述
Refused to load the image 'https://ade.googlesyndication.com/ddm/activity/src=10640035;type=navig0;cat=ifs-n0;ord=7688696202031;npa=1;u1=https%3A%2F%2Fwww.ifs.com%2F;gdid=dYWJhMj;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=denied;frm=0;gtm=45fe4cb0v9190178706z8857466672za201zb857466672;gcs=G100;gcd=13p3p3p2p5l1;dma_cps=-;dma=1;tag_exp=101925629~102067555~102067808~102081485~102198177;epver=2;~oref=https%3A%2F%2Fwww.ifs.com%2F?' because it violates the following Content Security Policy directive: "default-src 'self' data: blob: *.ifs.com *.justgiving.com *.searchstax.com *.twitter.com *.ads-twitter.com *.facebook.net https://*.onetrust.com https://*.sonobi.com https://*.spotxchange.com https://*.addthis.com https://*.socdm.com https://*.fout.jp https://*.stickyadstv.com https://*.adtdp.com *.litix.io *.demandbase.com *.wistia.com *.wistia.net embedwistia-a.akamaihd.net *.google-analytics.com www.googletagmanager.com *.googleadservices.com *.googleoptimize.com *.googleapis.com *.gstatic.com *.cloudflare.com *.leadforensics.com linkedin.oribi.io *.oribi.io *.t.co *.google.lk *.smartrecruiters.com *.mathtag.com *.doubleclick.net pixel.tapad.com *.marketo.com *.marketo.net *.linkedin.com *.krxd.net p.adsymptotic.com *.comparesoft.com tracking.g2crowd.com tr.apsislead.com static.oktopost.com tags.bkrtx.com snap.licdn.com *.rlcdn.com *.hotjar.com *.hotjar.io *.yahoo.com https://*.openx.net https://*.casalemedia.com https://*.bidswitch.net *.vendemore.com careers-p2energysolutions.icims.com https://*.adingo.jp *.clarity.ms www.facebook.com *.okt.to okt.to *.bluekai.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com dpm.demdex.net *.company-target.com *.mktoresp.com *.bidr.io ads.stickyadstv.co *.google.com/ads/ *.liadm.com siteimproveanalytics.com sync.navdmp.com *.zoominfo.com *.bing.com *.navdmp.com sync.crwdcntrl.net *.rubiconproject.com aa.agkn.com y.one.impact-ad.jp wss://*.hotjar.com https://*.adnxs.com https://*.pubmatic.com https://*.adsrvr.org https://*.adform.net https://*.shinobi.jp https://*.smaato.net https://*.semasio.net *.akstat.io *.akamaihd.net *.go-mpulse.net *.adsrvr.org marketing.ultimo.com *.mplat-ppcprotect.com *.o11.tech *.sentry-cdn.com *.mktoweb.com *.jquery.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.inzynk.io *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.vg *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat *.company-target.com *.marketo.com *.adoberesources.net *.adobe.com *.typekit.net *.adobe.io wss://*.adobe.io *.googleusercontent.com 'unsafe-inline' 'unsafe-eval'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
内容安全策略控制允许用户代理为指定页面加载的资源。

单击可了解更多信息...

证书 · 找到· 14 个

SSL/TLS 证书使网站能够加密客户端和服务器之间的事务并提供服务器身份验证

主题颁发日期到期日期
www.ifs.com2024年11月28日 11:43:272025年2月26日 11:43:26
cdnjs.cloudflare.com2024年11月26日 07:25:182025年2月24日 07:25:17
upload.video.google.com2024年11月4日 08:38:512025年1月27日 08:38:50
akstat.io2024年7月31日 00:00:002025年7月31日 23:59:59
webservices-production-com-cloudfront-app-cname.wistia.com2024年4月15日 00:00:002025年5月14日 23:59:59
fast.wistia.com2024年4月4日 00:50:102025年5月6日 00:50:09
*.google-analytics.com2024年11月4日 08:37:472025年1月27日 08:37:46
onetrust.com2024年12月11日 20:48:112025年3月11日 21:48:03
www.bing.com2024年9月16日 23:16:192025年3月15日 23:16:19
geolocation.onetrust.com2024年12月9日 18:59:532025年3月9日 19:59:51