Security Report Summary
D
Site: https://www.nmbe.ch/de
IP Address: 199.232.26.191
Report Time: 28 Oct 2026 05:09:06 UTC
Headers:
  • X-Content-Type-Options
  • X-Frame-Options
  • Strict-Transport-Security
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
Advanced:
Your site could be at risk, let’s perform a deeper security analysis of your site and APIs:
Missing Headers
Strict-Transport-SecurityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. Recommended value "Strict-Transport-Security: max-age=31536000; includeSubDomains".
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Raw Headers
HTTP/2200
content-typetext/html; charset=utf-8
x-drupal-dynamic-cacheHIT
content-languagede
x-content-type-optionsnosniff
x-frame-optionsSAMEORIGIN
expiresSun, 19 Nov 1978 05:00:00 GMT
cache-tagsconfig:block_list config:configurable_language_list block_content:1 config:domain.record.www_nmbe_ch config:matomo.settings node:50 paragraph_view paragraph:262 paragraph:12652 paragraph:12651 paragraph:7259 node_view node:736 media_view media:3103 config:responsive_image.styles.teaser config:image.style.default_landscape__sizes_640 config:image.style.default_landscape__sizes_160 config:image.style.default_landscape__sizes_320 config:image.style.default_landscape__sizes_480 user:167 paragraph:2205 node:90 media:3221 user:150 node:84 media:2866 node:296 media:3011 user:147 paragraph:261 config:views.view.recent_news_post_list node_list node:2039 node:2037 node:2074 media:3486 user:5305 media:3462 media:3564 node:875 media:2849 config:responsive_image.styles.fullscreen config:image.style.default_landscape__sizes_1120 config:image.style.default_landscape__sizes_800 config:image.style.default_landscape__sizes_1440 config:image.style.default_landscape__sizes_1600 config:image.style.default_landscape__sizes_1920 config:image.style.default_landscape__sizes_2240 config:image.style.default_landscape__sizes_2560 user:7155 node:1594 media:3190 node:2032 media:3481 rendered http_response config:user.role.anonymous block_content_view office_hours:field.status event_registration_time_slot:3475 node:2033 config:views.view.next_time_slot config:views.view.important_notice node:1644 config:system.menu.footer node:141 node:430 node:1520 node:145 node:62 config:system.menu.main-menu-3 node:309 node:94 node:96 node:95 config:system.menu.main-menu-2 node:82 node:103 node:85 node:83 config:system.menu.main-menu-1 config:field.storage.node.field_date config:field.storage.node.field_date_range config:field.storage.node.field_overline config:search_api.index.search search_api_list:search CACHE_MISS_IF_UNCACHEABLE_HTTP_METHOD:form config:antibot.settings
set-cookielanguage=de; expires=Thu, 28 Oct 2027 05:09:05 GMT; Max-Age=31535999; path=/; httponly; samesite=lax
x-lagoonamazeeio-ch4>ingress-nginx>nmbe-ch-master:nginx>nginx-68ff5889bd-8x7fr
content-encodinggzip
x-original-etagW/"1793164145"
x-original-last-modifiedWed, 28 Oct 2026 05:09:05 GMT
x-original-cache-controlmax-age=900, public, s-maxage=3600, stale-if-error=3600, stale-while-revalidate=3600
accept-rangesbytes
server-timingPASS, fastly;desc="Edge time";dur=119
dateWed, 28 Oct 2026 05:09:06 GMT
x-served-bycache-fra-eddf8230046-FRA, cache-dub4382-DUB
x-cacheMISS, MISS
x-cache-hits0, 0
x-timerS1793164146.942459,VS0,VE140
varyCookie, Accept-Encoding
cache-controlmax-age=900, public, s-maxage=3600, stale-if-error=3600, stale-while-revalidate=3600
server-timingPASS, fastly;desc="Edge time";dur=140
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.