content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Not able to connect via HTTP, so no redirection necessary

referrer-policy

Referrer-Policy header set to "no-referrer-when-downgrade"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to less than six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self' api-adresse.data.gouv.fr election-tpe.intranet.travail.gouv.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.piste.gouv.fr vqzw.election-tpe.travail.gouv.fr *.googletagmanager.com s2.adform.net connect.facebook.net; connect-src 'self' api-adresse.data.gouv.fr election-tpe-kc.travail.gouv.fr *.googlesyndication.com *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; img-src 'self' data: *.piste.gouv.fr jedonnemonavis.numerique.gouv.fr election-tpe.intranet.travail.gouv.fr vqzw.election-tpe.travail.gouv.fr *.google-analytics.com *.googletagmanager.com ad.doubleclick.net *.googlesyndication.com server.adform.net secure.adnxs.com px.ads.linkedin.com; media-src 'self' data: *.piste.gouv.fr www.youtube.com www.dailymotion.com election-tpe.intranet.travail.gouv.fr; style-src 'self' 'unsafe-inline' *.piste.gouv.fr; frame-src www.youtube.com www.dailymotion.com 3048978.fls.doubleclick.net td.doubleclick.net 3988071.fls.doubleclick.net; base-uri 'self'; form-action 'self'; frame-ancestors https://election-tpe.intranet.travail.gouv.fr;

Diagnostics

Metrics

__Secure-next-auth.callback-url

TS01556c60

__Host-next-auth.csrf-token

_fbp

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

React is an open-source JavaScript library for building user interfaces or UI components.

React

Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.

Amazon Web Services

Next.js is a React framework for developing single page Javascript applications.

Next.js

Emotion is a library designed for writing CSS styles with JavaScript.

Emotion

Google Analytics is a free web analytics service that tracks and reports website traffic.

Google Analytics

LinkedIn Insight Tag is a lightweight JavaScript tag that powers conversion tracking, website audiences, and website demographics.

Linkedin Insight Tag

Facebook pixel is an analytics tool that allows you to measure the effectiveness of your advertising.

Facebook Pixel

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Priority Hints exposes a mechanism for developers to signal a relative priority for browsers to consider when fetching resources.

Priority Hints

AppNexus is a cloud-based software platform that enables and optimizes programmatic online advertising.

AppNexus

Linkedin Ads is a paid marketing tool that offers access to Linkedin social networks through various sponsored posts and other methods.

Linkedin Ads

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Amazon Simple Email Service (SES) is an email service that enables developers to send mail from within any application.

Amazon SES

Webpack is an open-source JavaScript module bundler.

Webpack

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

name	domain	httpOnly	secure
__Secure-next-auth.callback-url	election-tpe.travail.gouv.fr	✔️	✔️
TS01556c60	election-tpe.travail.gouv.fr	❌	❌
__Host-next-auth.csrf-token	election-tpe.travail.gouv.fr	✔️	✔️
_fbp	.travail.gouv.fr	❌	❌

type	url	details
google tag manager	www.googletagmanager.com/...	Use hosted Matomo instance
unknown	secure.adnxs.com/px?id=17...
unknown	secure.adnxs.com/px?id=18...
unknown	secure.adnxs.com/px?id=18...
unknown	s2.adform.net/banners/scr...
facebook	connect.facebook.net/en_u...	Dont embed facebook scripts, use your own tweet embed
facebook	connect.facebook.net/sign...	Dont embed facebook scripts, use your own tweet embed
unknown	secure.adnxs.com/seg?t=2&...
unknown	pagead2.googlesyndication...
unknown	ade.googlesyndication.com...
unknown	ade.googlesyndication.com...

flag	country	hostname	ip	city
	France	election-tpe.travail.gouv.fr	176.31.133.214	?
	États Unis	www.googletagmanager.com	142.251.32.40	?
	États Unis	secure.adnxs.com	104.254.150.241	Los Angeles
	Danemark	s2.adform.net	185.167.166.40	?
	États Unis	connect.facebook.net	157.240.22.25	Santa Clara
	États Unis	pagead2.googlesyndication.com	142.251.32.34	?
	États Unis	ade.googlesyndication.com	142.250.72.194	?

https://election-tpe.travail.gouv.fr

LightHouse

https://election-tpe.travail.gouv.fr/environ 5 heures

Cookiesenviron 5 heures

Scripts tiersenviron 5 heures

Déclaration de mise en accessibilité

Conformité partielle