content-security-policy

Content Security Policy (CSP) implemented without 'unsafe-inline' or 'unsafe-eval'

cookies

Cookies set without using the Secure flag or set over HTTP

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to less than six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self'; img-src 'self' data: https://voxusagers.numerique.gouv.fr;

Diagnostics

Metrics

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only


Cookies without HttpOnly attribute - Detect

Checks whether cookies in the HTTP response contain the Secure attribute. If the Secure flag is set, it means that the cookie can only be transmitted over HTTPS


Cookies without Secure attribute - Detect

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

robots.txt endpoint prober

WAF Detection

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

dtPC

dtSa

rxvt

rxVisitor

bZA_

dtCookie

site historique des vehicules

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Dynatrace RUM is a AI powered, full stack, automated real user monutoring platform built by Dynatrace.

Dynatrace RUM

Dynatrace is a technology company that produces a software intelligence platform based on artificial intelligence to monitor and optimise application performance and development, IT infrastructure, and user experience for businesses and government agencies throughout the world.

Dynatrace

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

name	domain	httpOnly	secure
dtPC	.interieur.gouv.fr	❌	❌
dtSa	.interieur.gouv.fr	❌	❌
rxvt	.interieur.gouv.fr	❌	❌
rxVisitor	.interieur.gouv.fr	❌	❌
bZA_	histovec.interieur.gouv.fr	❌	❌
dtCookie	.interieur.gouv.fr	❌	❌

flag	country	hostname	ip	city
	France	histovec.interieur.gouv.fr	143.196.253.117	?

https://histovec.interieur.gouv.fr/histovec

LightHouse

https://histovec.interieur.gouv.fr/histovec31 minutes

Système de design de l'état

Eco-index

GES: 1.36 gramme(s) par visite

Eau : 2.04 cl par visite

Ça veut dire quoi ?

Cookies34 minutes

Scripts tiers34 minutes

Déclaration de mise en accessibilité

Conformité partielle