Security Report Summary
D
Site: https://cloudinary.com/
IP Address: 162.159.133.82
Report Time: 27 Oct 2026 22:18:07 UTC
Headers:
  • Content-Security-Policy
  • X-Frame-Options
  • Strict-Transport-Security
  • Referrer-Policy
  • Permissions-Policy
  • X-Content-Type-Options
Warning: Grade capped at A, please see warnings below.
Advanced:
Your site could be at risk, let’s perform a deeper security analysis of your site and APIs:
Missing Headers
Strict-Transport-SecurityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. Recommended value "Strict-Transport-Security: max-age=31536000; includeSubDomains".
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
X-Content-Type-OptionsWe couldn't detect a valid configuration. The only expected value for this header is "nosniff".
Content-Security-PolicyThis policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive.
Raw Headers
HTTP/2200
dateTue, 27 Oct 2026 22:18:07 GMT
content-typetext/html; charset=UTF-8
servercloudflare
varyAccept-Encoding, accept, content-type
host-headera9130478a60e5f9135f765b23f26593b
x-xss-protection
x-content-type-options
content-security-policydefault-src 'self' *.crazyegg.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' cloudinary.com *.cloudinary.com *.googletagmanager.com www.google-analytics.com *.google.com cdnjs.cloudflare.com unpkg.com cdn.jsdelivr.net stackpath.bootstrapcdn.com app-ab12.marketo.com snap.licdn.com *.zoominfo.com connect.facebook.net munchkin.marketo.net consent.cookiebot.com vidassets.terminus.services googleads.g.doubleclick.net radar.cedexis.com www.googleadservices.com maps.googleapis.com *.fastcdn.co *.instapage.com *.instapagemetrics.com *.redditstatic.com *.gstatic.com *.crazyegg.com *.wp.com *.driftt.com script.mocky.com *.googleoptimize.com *.6sc.co ml314.com tags.srv.stackadapt.com *.convertexperiments.com *.infinigrow.com cdn.debugbear.com cdn.cookielaw.org *.onetrust.com js.zi-scripts.com ws-assets.zoominfo.com tracking-api.g2.com *.adroll.com cdn.cr-proxy.com ddzuuyx7zj81k.cloudfront.net cdn.parsely.com *.openai.com; script-src-elem 'self' 'unsafe-inline' cloudinary.com *.cloudinary.com *.openai.com *.crozdesk.com code.jquery.com *.amazonaws.com cdn.jsdelivr.net cdn.parsely.com cdn.cr-proxy.com stackpath.bootstrapcdn.com *.googletagmanager.com www.google-analytics.com *.google.com *.zoominfo.com cdn.omniconvert.com *.calibermind.com unpkg.com app-ab12.marketo.com snap.licdn.com connect.facebook.net munchkin.marketo.net consent.cookiebot.com vidassets.terminus.services googleads.g.doubleclick.net radar.cedexis.com www.googleadservices.com maps.googleapis.com *.fastcdn.co *.instapage.com *.instapagemetrics.com *.redditstatic.com *.gstatic.com *.crazyegg.com *.wp.com *.driftt.com script.mocky.com *.googleoptimize.com ml314.com *.6sc.co bat.bing.com static.ads-twitter.com www.clarity.ms tags.srv.stackadapt.com app.omniconvert.com web.omniconvert.com *.convertexperiments.com *.infinigrow.com ddzuuyx7zj81k.cloudfront.net dss6ntp5q2r0o.cloudfront.net cdnjs.cloudflare.com cdn.debugbear.com cdn.cookielaw.org *.onetrust.com js.zi-scripts.com ws-assets.zoominfo.com tracking-api.g2.com *.adroll.com app.convert.com cdn.cr-proxy.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.typekit.net unpkg.com cdnjs.cloudflare.com app-ab12.marketo.com *.google.com *.cloudinary.com *.crazyegg.com *.wp.com *.driftt.com script.mocky.com *.googleoptimize.com tags.srv.stackadapt.com cdn.jsdelivr.net cdn.cookielaw.org *.googletagmanager.com; style-src-elem 'self' 'unsafe-inline' fonts.googleapis.com *.googletagmanager.com *.typekit.net unpkg.com cdnjs.cloudflare.com app-ab12.marketo.com *.google.com *.cloudinary.com *.crazyegg.com *.wp.com *.driftt.com script.mocky.com *.googleoptimize.com tags.srv.stackadapt.com cdn.jsdelivr.net cdn.cookielaw.org; img-src 'self' data: cloudinary.com *.cloudinary.com *.postrelease.com *.stackadapt.com *.googleadservices.com sync-tm.everesttech.net *.crozdesk.com *.taboola.com s.seedtag.com *.facebook.net *.google.com www.google-analytics.com pagead2.googlesyndication.com cm.g.doubleclick.net www.google.co.uk www.google.de www.google.hr www.google.co.il www.google.es *.google.com rtb-csync.smartadserver.com match.sharethrough.com d.turn.com onetag-sys.com pm.w55c.net p1.parsely.com p1-irl.parsely.com pix.revjet.com sync.smartadserver.com sync.adstir.com sync.commander1.com ardrone.swoop.com tag.crsspxl.com segments.company-target.com ps.eyeota.net googleads.g.doubleclick.net secure.gravatar.com match.adsrvr.org wec-assets.terminus.services wec-assets-api.terminus.services px.ads.linkedin.com *.google.ca *.facebook.com benchmark.1e100cdn.net *.cedexis-test.com cedexis.pc.cdn.bitgravity.com ptcfc.com ubiquity.cedexis.us-east-1.prod.endpoints.ubiquity.aws.a2z.com media-akam.licdn.com *.citrix-itm-test.com ubiquity.cedexis.eu-west-1.prod.endpoints.ubiquity.aws.a2z.com direct.cedexis.us-east-1.prod.endpoints.ubiquity.aws.a2z.com a-cedexis.msedge.net 20059b.ha.azioncdn.net *.cedexis.fastlylb.net test.cedexis.gamma.endpoints.ubiquity.aws.a2z.com *.cdnvideo.ru essl-cdxs.edgekey.net direct.cedexis.ap-northeast-1.prod.endpoints.ubiquity.aws.a2z.com *.endpoints.ubiquity.aws.a2z.com level3ssl.optimicdn.com img-cedexis.mncdn.com cedexis-ssl.cdn.warpcache.net linkedin.com *.adsymptotic.com *.google.com www.googleapis.com *.gstatic.com maps.googleapis.com *.citrix.com cldmo.mo.cloudinary.net *.googletagmanager.com *.fastcdn.co *.instapage.com px4.ads.linkedin.com alb.reddit.com *.crazyegg.com *.mozilla.org *.imagecon.com script.mocky.com b.6sc.co bat.bing.com t.co analytics.twitter.com *.clarity.ms *.convertexperiments.com *.bing.com cdn.cookielaw.org dimensions-art.cloudinary.net n902wcigxi.execute-api.us-east-1.amazonaws.com *.adroll.com p28416.itm.cloud.com p118600.itm.cloud.com ml314.com x.bidswitch.net pixel.tapad.com dsum-sec.casalemedia.com sync.outbrain.com idsync.rlcdn.com pixel.rubiconproject.com image2.pubmatic.com us-u.openx.net sync.taboola.com eb2.3lift.com ib.adnxs.com *.reson8.com secure.adnxs.com dpm.demdex.net i.liadm.com; font-src 'self' 'unsafe-inline' data: fonts.gstatic.com cdnjs.cloudflare.com use.typekit.net bat.bing.com t.co analytics.twitter.com *.wp.com cdn.cookielaw.org; connect-src 'self' cloudinary.com *.cloudinary.com www.google-analytics.com *.crozdesk.com *.googleadservices.com *.zoominfo.com pagead2.googlesyndication.com *.openai.com *.mktoutil.com *.doubleclick.net *.calibermind.com api.lever.co api.cr-proxy.com *.mktoresp.com *.init.cedexis-radar.net *.cedexis.com *.facebook.com a-cedexis.msedge.net *.cedexis.fastlylb.net *.netlify.app *.instapage.com *.instapagemetrics.com *.crazyegg.com script.mocky.com mocky.com *.google.com secure.adnxs.com c.6sc.co ipv6.6sc.co *.clarity.ms bat.bing.com tags.srv.stackadapt.com app.omniconvert.com *.convertexperiments.com *.metrics.convertexperiments.com logs.convertexperiments.com *.linkedin.com *.cookiebot.com *.infinigrow.com data.debugbear.com cdn.cookielaw.org epsilon.6sense.com *.6sc.co *.onetrust.com js.zi-scripts.com ws-assets.zoominfo.com ws.zoominfo.com tracking-api.g2.com n902wcigxi.execute-api.us-east-1.amazonaws.com *.algolia.net dss6ntp5q2r0o.cloudfront.net *.adroll.com cdn.jsdelivr.net; media-src 'self' cloudinary.com *.cloudinary.com blob:; worker-src 'self' blob:; frame-src stackblitz.com demo.arcade.software *.googletagmanager.com *.doubleclick.net *.productboard.com *.google.com jobs.lever.co app-ab12.marketo.com business.facebook.com consentcdn.cookiebot.com *.facebook.com *.cedexis-test.com cedexis.pc.cdn.bitgravity.com *.citrix-itm-test.com 20059b.ha.azioncdn.net essl-cdxs.edgekey.net *.cloudinary.com bid.g.doubleclick.net *.twitter.com cloudinary.com *.youtube.com *.driftt.com *.crazyegg.com *.wp.com p28416.itm.cloud.com p118600.itm.cloud.com app.convert.com; object-src 'none'; frame-ancestors 'self' highspot.com *.highspot.com
link<https://cloudinary.com/wp-json/>; rel="https://api.w.org/"
link<https://cloudinary.com/wp-json/wp/v2/pages/59630>; rel="alternate"; title="JSON"; type="application/json"
x-cacheHIT
cache-controlpublic, max-age=43200
x-rqams5 0 20 9980
x-rememberingEric Binnion <https://friendsofericbinnion.wordpress.com/>
age4
last-modifiedTue, 27 Oct 2026 22:18:05 GMT
expiresWed, 28 Oct 2026 10:18:07 GMT
cf-cache-statusHIT
set-cookie__cf_bm=tmWA0uS6rlDtsK3zKKKj76GwY2LVgWHRKrHK6TDiICk-1793139487.1369727-1.0.1.1-kpS83wJqeBVp4YFRF2wsB8M56FkPmNVqlBrsKiVdfqrPdDVlkKqzmshoawp14U6xQ48ZhUcB4xLHxTXAI3vRaF6QVH1YBfKhVpjcDbhMqi41h8q2efm50qtuNFf1r3yq; HttpOnly; SameSite=None; Secure; Path=/; Domain=cloudinary.com; Expires=Tue, 27 Oct 2026 22:48:07 GMT
set-cookie_cfuvid=J4gvzVI41qQcRDTvRhuXCQun1wOZlhcprFijuWsLS3k-1793139487.1369727-1.0.1.1-ZPJCOOyyIBo11SD4HT6sTB1WMminhjHphqjEduLBbU4; HttpOnly; SameSite=None; Secure; Path=/; Domain=cloudinary.com
content-encodinggzip
cf-raya51513229e04f54a-DUB
alt-svch3=":443"; ma=86400
X-Frame-OptionsHeader not set, see Additional Information below.
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
serverServer value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".
x-xss-protectionX-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
content-security-policyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
X-Frame-OptionsThe XFO header was not sent but frame-ancestors in Content Security Policy was used instead.