Security Report Summary
A
Site: https://www.banquedesterritoires.fr/
IP Address: 23.1.228.143
Report Time: 28 Oct 2026 12:45:53 UTC
Headers:
  • X-Content-Type-Options
  • Content-Security-Policy
  • Strict-Transport-Security
  • Referrer-Policy
  • X-Frame-Options
  • Permissions-Policy
Advanced:
Great grade! Perform a deeper security analysis of your website and APIs:
Missing Headers
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
X-Content-Type-OptionsThere was a duplicate X-Content-Type-Options header.
Raw Headers
HTTP/2200
cache-controlmax-age=31536000, public
content-languagefr
x-content-type-optionsnosniff
expiresSun, 19 Nov 1978 05:00:00 GMT
content-security-policy-report-onlyobject-src 'none'; script-src 'self' https://api.mapbox.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com unpkg.com; script-src-attr 'self' 'unsafe-inline'; script-src-elem * 'unsafe-inline'; style-src 'self' cdnjs.cloudflare.com https://api.mapbox.com https://cdnjs.cloudflare.com https://unpkg.com unpkg.com; style-src-attr 'self' 'unsafe-inline'; style-src-elem * 'unsafe-inline'; frame-ancestors 'self'
content-security-policyobject-src 'none'; frame-ancestors 'self'
cache-tagsconfig:block_list config:block.block.themebdtneva_pagetitle node:114716 config:block.block.themebdtneva_offreurs config:block.block.themebdtneva_bdt_messages config:block.block.themebdtneva_bdt_mainpagecontent config:block.block.srjfblock_view config:block.block.seeallthematicslocaltisrss config:block.block.pagetitle config:block.block.offererlistheaderblock config:block.block.localtisblock config:block.block.collabspaceblock config:block.block.newslettertcblock config:block.block.breadcrumb config:block.block.menulocaltis config:block.block.localtismenuheaderblock config:block.block.quefaisonsnous config:block.block.nosmissions config:block.block.whitepaperformblock config:block.block.confirmationdedesabonnementauxalertes config:block.block.hubterritoriesblock config:block.block.themebdtneva_marquedusite config:block.block.navigationprincipale config:block.block.headersearchblock config:block.block.connexionbuttonblock_account config:block.block.themebdtneva_bdt_tabs config:block.block.themebdtneva_bdt_primaryadminactions config:block.block.themebdtneva_bdt_help config:block.block.socialmedialinks_footer config:block.block.menufooter config:block.block.footercommun config:block.block.footersegment config:block.block.searchtabscontainerblock config:block.block.searchbar. config:block.block.resetfacets_2 config:block.block.itemsperpage. config:block.block.filter_summary config:block.block.current_view_facets config:block.block.curent_view_exposed_filters config:block.block.bdtlinktodrmaponsolutionpage config:block.block.bdtlinktodrinprivateportal config:block.block.blockcontent404 block_content:11 config:block.block.menusegments config:block.block.icons_menu config:block.block.bdtalert config:lazy.settings config:extlink.settings block_view node_view paragraph_view paragraph:42965 config:paragraphs.settings paragraph:42962 paragraph:42961 paragraph:42960 paragraph:42964 paragraph:42963 paragraph:43622 node:122886 taxonomy_term:12689 taxonomy_term:99 taxonomy_term:12683 media_view media:39152 config:image.style.compressed file:58981 user:2213 paragraph:43621 node:122454 taxonomy_term:62 media:39032 file:58843 user:2212 node:96886 config:filter.format.full_html paragraph:42957 paragraph:42959 paragraph:43629 user:0 paragraph:43628 node:122644 paragraph:43630 node:96801 user:1353 node:120223 paragraph:42958 paragraph:43626 paragraph:43627 node:120229 user:2210 paragraph:43625 node:121536 node:110932 paragraph:42956 paragraph:43624 media:19245 file:36207 user:2132 paragraph:43623 node:113670 media:19250 file:36212 user:2140 paragraph:43620 node:110413 media:19268 file:36230 user:2146 paragraph:42954 paragraph:42955 paragraph:43608 config:filter.format.basic_html paragraph:42952 paragraph:47495 paragraph:49401 paragraph:45859 paragraph:42951 user:2149 block_content_list config:system.menu.icons-menu config:system.site rendered http_response config:user.role.anonymous config:system.menu.common-footer node:20 node:21 node:16 node:17 node:86666 node:97938 config:system.menu.menu-footer node:96782 node:92034 config:system.menu.segments-menu node:1 node:96627 node:96686 node:13 node:14 node:110085 node:110086 node:110096 node:110153 node:106951 config:system.menu.main node:110840 node:96679 node:117458 node:117459 node:117460 node:117461 node:117462 node:117464 node:117465 node:117466 node:117467 node:117468 node:117469 node:99357 node:109837 node:96682 node:119406 node:119965 node:110051 node:120371 node:99113 node:121075 node:121291 node:119581 node:95508 node:95801 node:115790 node:106373 node:94533 node:101518 node:114120 node:110971 node:96704 node:110044 node:110043 node:124377 node:110045 node:117944 node:110048 node:105308 node:110005 node:110046 node:110047 node:112795 node:96754 node:89407 node:107970 node:90824 node:92078 node:93555 node:96759 node:98736 paragraph:26199 paragraph:26200 paragraph:26198 media:25204 config:image.style.logo_list file:43265 paragraph:26197 paragraph:26195 media:27730 file:46233 paragraph:39244 paragraph:39243 paragraph:39115 media:31436 file:50390 paragraph:26190 media:26592 file:44906 paragraph:39237 paragraph:38922 media:37597 file:57253 local_task config:workflows.workflow.create_tobepublished_published scheduled_transitions_for:node:114716 config:csp.settings library_info
strict-transport-securitymax-age=15768000; includeSubDomains; preload
last-modifiedWed, 28 Oct 2026 11:02:13 GMT
etag"1793185333-gzip"
content-encodinggzip
x-content-type-optionsnosniff
x-permitted-cross-domain-policiesnone
referrer-policysame-origin
content-typetext/html; charset=UTF-8
x-cache-hits0
x-frame-optionsSAMEORIGIN
x-cdnImperva
x-iinfo34-27958627-28058063 NNNN CT(12 21 0) RT(1793184720408 613158) q(0 0 0 -1) r(3 3) U24
content-length33048
dateWed, 28 Oct 2026 12:45:53 GMT
varyAccept-Encoding
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
content-security-policy-report-onlyContent Security Policy Report Only is used to test a Content Security Policy before making it live. The browser will report on actions that would have been taken based on the policy. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
content-security-policyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
referrer-policyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.