Security Report Summary
D
Site: https://www.livenation.fr/
IP Address: 199.232.25.237
Report Time: 28 Oct 2026 06:32:44 UTC
Headers:
  • Content-Security-Policy
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Permissions-Policy
  • Strict-Transport-Security
Warning: Grade capped at A, please see warnings below.
Advanced:
Your site could be at risk, let’s perform a deeper security analysis of your site and APIs:
Missing Headers
X-Frame-OptionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN".
X-Content-Type-OptionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
Strict-Transport-SecurityThe "max-age" directive is too small. The minimum recommended value is 2592000 (30 days).
Content-Security-PolicyThis policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive.
Raw Headers
HTTP/2200
x-timerS1793169164.883025,VS0,VE155
accept-rangesbytes
age0
strict-transport-securitymax-age=300
content-typetext/html; charset=utf-8
cache-controlmax-age=0, s-maxage=60, stale-while-revalidate=10
content-encodinggzip
link<https://networksites.livenationinternational.com/networksites/lbxlwtw5/ln-logo-primary-red-40px.svg>; rel=preload; as="image"
content-security-policydefault-src 'self' komocdn.com *.komocdn.com *.komo.site *.googlesyndication.com global.ketchcdn.com cdn.ketchjs.com; style-src 'self' *.komo.site 'unsafe-inline' *.livenationinternational.com *.onetrust.com *.googleapis.com *.monetate.net *.amondo.com tagmanager.google.com global.ketchcdn.com cdn.ketchjs.com platform.twitter.com use.fontawesome.com rsms.me fonts.bunny.net; img-src 'self' data: komocdn.com *.komocdn.com *.komo.site *.lne.prod.tmaws.eu *.lne.nonprod.public.tmaws.eu *.lne.nonprod.tmaws.eu *.livenationinternational.com www.lntvglobal.com *.2mdn.net *.betrad.com *.celtra.com *.doubleverify.com *.evidon.com *.facebook.com *.g.doubleclick.net *.googleapis.com *.googlesyndication.com *.googletagservices.com *.gstatic.com *.mgr.consensu.org *.monetate.net *.ticketm.net *.tmol.co *.quantserve.com *.quantcount.com *.youtube.com *.adzip.co *.twitter.com *.tiktokcdn.com *.scdn.co *.twimg.com *.analytics.google.com *.google-analytics.com ad.doubleclick.net ads.celtra.com adservice.google.com dt.adsafeprotected.com cache-ssl.celtra.com media.ticketmaster.com media.ticketmaster.co.uk pixel.adsafeprotected.com pixel.moatads.com px.moatads.com secure.adnxs.com tagmanager.google.com track.celtra.com www.google.co.uk www.google.com www.googletagmanager.com api.permutive.com cdn.permutive.com *.permutive.app cdn.cookielaw.org insight.adsrvr.org match.adsrvr.org fxctag.com googlesync.permutive.com t.co tr.snapchat.com b97.yahoo.co.jp appboy-images.com braze-images.com cdn.braze.eu media.amondo.com static.amondo.com ids4.ad.gt ids.ad.gt ep1.adtrafficquality.google alb.reddit.com global.ketchcdn.com cdn.ketchjs.com u.openx.net image2.pubmatic.com token.rubiconproject.com ad.360yield.com bh.contextweb.com sync.1rx.io onetag-sys.com connect.facebook.net; script-src 'self' js-cdn.music.apple.com global.ketchcdn.com cdn.ketchjs.com *.komo.site 'unsafe-inline' 'unsafe-eval' cdn.hadronid.net cdn1.anonymised.io *.livenationinternational.com *.2mdn.net static.anonymised.io anonymised.io *.bannersnack.com *.doubleverify.com *.evidon.com *.g.doubleclick.net *.google.com *.googleapis.com *.googlesyndication.com *.googletagservices.com *.gstatic.com *.lytics.io *.quantcount.com *.monetate.net *.universe.com *.adzip.co *.tiktok.com *.tiktokcdn.com *.amondo.com *.onetrust.com cdn.cookielaw.org cdn.ampproject.org ad.doubleclick.net ads.celtra.com adservice.google.co.uk adservice.google.com bam.nr-data.net cache-ssl.celtra.com connect.facebook.net evidon.mgr.consensu.org js-agent.newrelic.com pixel.adsafeprotected.com secure.adnxs.com secure.quantserve.com static.adsafeprotected.com tagmanager.google.com widget.ticketmaster.eu www.google-analytics.com www.googletagmanager.com z.moatads.com api.permutive.com cdn.permutive.com www.instagram.com analytics.twitter.com platform.twitter.com cdn.syndication.twimg.com secure.wufoo.com static.ads-twitter.com js.adsrvr.org fxctag.com sc-static.net tag.lexer.io www.googleadservices.com s.yimg.jp b92.yahoo.co.jp js.appboycdn.com tag.durationmedia.net be.durationmedia.net stage-be.durationmedia.net stage-tag.durationmedia.net tpc.googlesyndication.com securepubads.g.doubleclick.net googleads.g.doubleclick.net pagead2.googlesyndication.com safeframe.googlesyndication.com cdn.confiant-integrations.net rumcdn.geoedge.be tr.snapchat.com a.ad.gt id.hadron.ad.gt p.ad.gt pixels.ad.gt ep2.adtrafficquality.google ads.pubmatic.com tradablebits.com s.pinimg.com www.redditstatic.com ct.pinterest.com serverdb2.flashstalking.com cdn.jsdelivr.net unpkg.com cdn.permutive.app static.criteo.net oa.openxcdn.net tags.crwdcntrl.net invitation101.creativedcn.com fw.adsafeprotected.com; connect-src 'self' *.komo.site cdn.cookielaw.org https://global.ketchcdn.com cdn.ketchjs.com user-segments.anonymised.io *.be.durationmedia.net graphql-cached.amondo.com api.anonymised.io *.doubleverify.com material.anonymised.io aegis.anonymised.io *.evidon.com *.g.doubleclick.net *.googleapis.com *.googlesyndication.com *.permutive.com *.permutive.app *.quantserve.com *.quantcount.com *.tmol.co *.tmol.io *.prmutv.co *.analytics.google.com *.google-analytics.com *.amondo.com be.durationmedia.net *.onetrust.com csi.gstatic.com vendorlist.consensu.org widget.ticketmaster.eu www.googletagmanager.com track.celtra.com analytics.google.com analytics.tiktok.com ib.adnxs.com www.google.com sdk.iad-05.braze.com durationmedia-d.openx.net rtb.openx.net u.openx.net js-sec.indexww.com dsum.casalemedia.com htlb.casalemedia.com ssp.theadx.com bid.contextweb.com bh.contextweb.com t.pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com image8.pubmatic.com ads.servenobid.com public.servenobid.com sync.1rx.io ap.lijit.com sync.adkernel.com adservice.google.com www.ticketmaster.co.uk www.ticketmaster.co.nz www.ticketmaster.com.au www.ticketmaster.de tr.snapchat.com ep1.adtrafficquality.google a.ad.gt seg.ad.gt p.ad.gt id.hadron.ad.gt ad.doubleclick.net www.facebook.com analytics-ipv6.tiktokw.us insight.adsrvr.org pixel-config.reddit.com www.redditstatic.com conversions-config.reddit.com ct.pinterest.com tr6.snapchat.com *.ecs.us-west-2.on.aws *.ecs.us-east-1.on.aws demo-1.conversionsapigateway.com *.us-central1.run.app; font-src 'self' *.amondo.com *.livenationinternational.com *.onetrust.com fonts.gstatic.com widget.ticketmaster.eu use.fontawesome.com rsms.me static.amondo.com s3-res.amondo.com fonts.bunny.net; frame-src *.2mdn.net account.anonymised.io *.bannersnack.com static.anonm.io *.doubleverify.com *.dvtps.com *.evidon.com *.facebook.com *.fls.doubleclick.net *.googlesyndication.com *.googletagservices.com *.jebbit.com *.monetate.net *.ticketmaster.co.uk *.twitch.tv *.bilibili.com *.player.vimeo.com *.soundcloud.com *.instagram.com *.twitter.com *.spotify.com *.tiktok.com *.tiktokcdn.com *.youtube.com *.youtu.be cookies.onetrust.mgr.consensu.org music.163.com player.vimeo.com secureframe.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net eus.rubiconproject.com terriverhoeven.wufoo.com universe.queue-it.net v.qq.com www.google.com www.universe.com insight.adsrvr.org tr.snapchat.com static.amondo.com rsms.me www.googletagmanager.com td.doubleclick.net securepubads.g.doubleclick.net ep2.adtrafficquality.google proton.ad.gt www.googleadservices.com public.servenobid.com eu-u.openx.net ads.pubmatic.com match.adsrvr.org ct.pinterest.com; media-src 'self' *.amondo.com *.lne.nonprod.public.tmaws.eu *.lne.nonprod.tmaws.eu www.lntvglobal.com *.livenationinternational.com video.amondo.com; worker-src 'self' blob:;
via1.1 varnish, 1.1 varnish
dateWed, 28 Oct 2026 06:32:44 GMT
x-served-bycache-dub4399-DUB, cache-dub4399-DUB, cache-dub4399-DUB
x-cacheMISS, MISS, MISS
x-cache-hits0, 0, 0
varyrsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding,x-ucm,x-culture
set-cookieSID=NPEYbdm6ht0_ZhzSFEnIJNvSg89Q996cF6Nf95m2s9ht5Wqbe-eqi1wqsr4FEuP6CHBtYvS34SaYqy3p; Domain=.livenation.fr; Path=/; Secure; HttpOnly; SameSite=None
set-cookieBID=xFLzUFsdw_w2AyaDaERrJOvg1Mh7OuzYjmfhGOBEmWrAeQav0saoOkJNQeO4OZ8-PPkP8FPoRekXrLms; Domain=.livenation.fr; Max-Age=31536000; Expires=Thu, 28 Oct 2027 06:32:44 GMT; Path=/; Secure; HttpOnly; SameSite=None;
content-length76194
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
content-security-policyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.