content-security-policy

Content Security Policy (CSP) header not implemented

cookies

All cookies use the Secure flag and all session cookies use the HttpOnly flag

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) is implemented and all scripts are loaded securely

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

Diagnostics

Metrics

BIGipServerpool-dgefp-aspe.cegedim.cloud-HTTP

Modernizr is a JavaScript library that detects the features available in a user's browser.

Modernizr

jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.

jQuery CDN

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

Google Font API is a web service that supports open-source font files that can be used on your web designs.

Google Font API

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		Doc header X-Frame-Options.

https://bonusmalus.travail-emploi.gouv.fr

Mozilla HTTP observatoryenviron 7 heures

SSL

Expiration : 06/10/2025