content-security-policy

Content Security Policy (CSP) header not implemented

cookies

All cookies use the Secure flag and all session cookies use the HttpOnly flag

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header not implemented

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header not implemented

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

Diagnostics

Metrics

BIGipServerpool-www.hcfea-portail-prod.cegedim.cloud-HTTP

SPIP is a content management system written in PHP that uses one or more databases like SQL, SQLite or PostgreSQL.

SPIP

PHP is a general-purpose scripting language used for web development.

Debian is a Linux software which is a free open-source software.

Debian

MooTools

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		Doc header Strict-Transport-Security (HSTS).
-20		Doc header X-Frame-Options.
-5		Doc header X-Content-Type-Options.

https://hcfea.fr

Mozilla HTTP observatoryenviron 4 heures

SSL

Grade capped to A. HSTS is not offered

Expiration : 01/06/2025