content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self' https:; base-uri https://www.elysee.fr; block-all-mixed-content; child-src *; font-src 'self' data: https://fonts.gstatic.com https://www.elysee.fr https://admin.elysee.fr https://www.elysee.fr; form-action 'self'; frame-ancestors 'none'; img-src https://stats.g.doubleclick.net data: https://www.elysee.fr https://admin.elysee.fr https://www.elysee.fr https://captcha.liveidentity.com; plugin-types video/*; script-src 'unsafe-inline' https://www.elysee.fr https://isho.elysee.fr https://admin.elysee.fr https://www.elysee.fr; style-src https://fonts.googleapis.com 'unsafe-inline' https://www.elysee.fr https://admin.elysee.fr https://www.elysee.fr

Diagnostics

Metrics

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS SaaS Service Detection

The detected website has decided to explicitly exclude itself from Google FLoC tracking.

Google FLoC Disabled

Wappalyzer Technology Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

IBM API Connect Developer Portal was detected.

IBM API Connect Developer Portal - Detect

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

Le site officiel de l'Elysée

Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.

Sentry

Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.

Firebase

Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.

Cloudflare Browser Insights

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

Open Graph is a protocol that is used to integrate any web page into the social graph.

type	url	details
cloudflare	static.cloudflareinsights...	Host files locally
unknown	isho.elysee.fr/wdw636.js?...

flag	country	hostname	ip	city
	?	www.elysee.fr	104.18.30.248	?
	?	static.cloudflareinsights.com	104.16.79.73	?
	France	isho.elysee.fr	91.134.109.31	?

https://www.elysee.fr

LightHouse

https://www.elysee.fr/environ 1 heure

Système de design de l'état

Eco-index

GES: 2.18 gramme(s) par visite

Eau : 3.27 cl par visite

Ça veut dire quoi ?

Cookiesenviron 1 heure

Scripts tiersenviron 1 heure

Déclaration de mise en accessibilité

Conformité partielle