Security Report Summary
C
Site: https://www.fhcm.paris/fr
IP Address: 54.37.211.165
Report Time: 28 Oct 2026 05:35:23 UTC
Headers:
  • X-Content-Type-Options
  • X-Frame-Options
  • Strict-Transport-Security
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
Advanced:
Not bad… Maybe you should perform a deeper security analysis of your website and APIs:
Missing Headers
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Raw Headers
HTTP/2200
content-typetext/html; charset=UTF-8
varyAccept-Encoding, Cookie
cache-controlmax-age=31536000, public
dateTue, 27 Oct 2026 23:16:03 GMT
content-languagefr
x-content-type-optionsnosniff
x-frame-optionsSAMEORIGIN
expiresSun, 19 Nov 1978 05:00:00 GMT
last-modifiedTue, 27 Oct 2026 23:16:03 GMT
etagW/"1793142963"
cache-tagsconfig:block_list config:block.block.fhcm_secondary_local_tasks user:0 config:block.block.fhcm_primary_local_tasks config:block.block.fhcm_primary_admin_actions config:block.block.fhcm_page_title config:block.block.fhcm_messages config:block.block.entete config:block.block.home_intro config:block.block.fhcm_content config:block.block.push_home config:block.block.home_links config:block.block.home_msg config:block.block.home_gal config:block.block.news_home config:block.block.blocsedition config:block.block.listedesmaisonsbloc config:block.block.partners config:block.block.newsletter config:block.block.footer config:asset_injector.js.hide_deprecated_warnings config:asset_injector.js.loreal config:google_analytics.settings block_view site_setting_entity_list:social_links site_setting_entity:9 node:1934 node:1935 config:system.menu.footer site_setting_entity_view site_setting_entity:4 site_setting_entity:3 site_setting_entity:31 config:filter.format.bold_links site_setting_entity:2 local_task rendered http_response config:user.role.anonymous config:views.view.partners node_list node:7136 node:3271 node:1649 node:1650 node_view config:image.style.logo file:141419 user:1158 file:141884 user:10 file:7013 user:1 file:7017 node:8998 taxonomy_term:14 node:9025 taxonomy_term:67 node:9028 node:9050 config:image.style.half file:195188 node:9659 node:9662 node:9701 taxonomy_term:31 node:9707 file:214976 node:8432 taxonomy_term:16 node:8472 taxonomy_term:17 user:1155 node:8607 node:7079 file:140156 site_setting_entity:73 node:9617 node:566 config:image.style.cslider file:214886 user:81 node:9728 node:653 file:218522 user:12 node:9734 node:2335 file:216590 node:9731 node:565 file:217508 node:9740 node:7844 file:217103 node:9758 node:584 file:218756 node:9704 node:557 file:214304 node:9725 node:713 file:218823 node:9434 node:692 file:212861 node:9437 node:655 file:213392 node:9073 site_setting_entity_list:header config:system.site site_setting_entity:70 node:1930 node:1931 node:1932 node:1933 node:1929 node:8454 node:8457 config:system.menu.main config:image.style.mc file:29300 file:29301 file:29302 file:29303 config:configurable_language_list
content-encodinggzip
age22732
accept-rangesbytes
x-varnish-cacheHIT
content-length9249
strict-transport-securitymax-age=31536000; includeSubDomains; preload
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.