WebForensik

Results for https://more-eyes.de/

Scan time: 2026-11-04 18:09:29

Subpages included in this scan: https://more-eyes.de/ · https://more-eyes.de/datenschutz/ · https://more-eyes.de/impressum/ · https://more-eyes.de/apps/meola/en/

Overall Score

Score history for this domain View full history →

95 03.11. 95 03.11. 95 03.11. 95 03.11. 95 03.11. 95 03.11. 95 03.11. 95 04.11. 95 04.11. 95 04.11.

GDPR Summary

✔ This website meets basic data protection requirements.

Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.

↓ See detailed results for each category below.

100 HTTPS / Encryption

The website uses an encrypted connection (HTTPS).

Latest encryption active (TLS 1.3 — TLSv1.3).

The security certificate is valid (expires 2027-01-20).

Strong encryption method (TLS_AES_256_GCM_SHA384, 256 bit).

90 Enforced Encryption (HSTS)

HSTS is enabled — the browser is instructed to always use the encrypted connection.

HSTS duration: 31536000 seconds (at least 1 year) — very good.

HSTS also applies to all subdomains (includeSubDomains).

75 Content Security Policy (CSP)

Content Security Policy present (via HTTP-Header).

Script sources are properly restricted.

Embedding protection (frame-ancestors) is configured — protects against clickjacking.

Good base rule: only own content is allowed by default (default-src: self).

100 Referrer Policy

Referrer-Policy: strict-origin-when-cross-origin (via HTTP-Header).

Strict setting "strict-origin-when-cross-origin" — no path leak, no HTTP downgrade leak. Best practice.

100 MIME Type Protection

MIME type protection active (nosniff) — browsers will not misinterpret files.

100 Clickjacking Protection

Clickjacking protection active via CSP frame-ancestors.

100 Permissions (Camera, Microphone, etc.)

Permissions-Policy is configured — access to sensitive device APIs is controlled.

5 of 6 sensitive APIs restricted — very good.

100 Cookies

No cookies set — exemplary for privacy.

100 Local Storage (Web Storage)

No local storage (Web Storage) used — no tracking risk.

100 Third-Party Requests

No third-party requests detected — all content comes from the website's own server.

100 Tracker Detection

No known trackers detected.

100 External Resource Integrity (SRI)

No external scripts or stylesheets loaded.

90 DNS Security

CAA records present: letsencrypt.org, sectigo.com, digicert.com — only specified certificate authorities may issue certificates.

4 nameservers present — good redundancy.

No IPv6 support (no AAAA record).

☛ Action needed: Enable IPv6 support (AAAA records) for your domain. More and more users are using IPv6.

▸ How to fix this — step-by-step guide

Your domain has no IPv6 address (AAAA record). Over 40% of users (especially mobile) reach the internet via IPv6 — they must take the slower IPv4 gateway detour.

WordPress Special for WordPress: where to add this

WordPress plugin: Pure DNS + server matter. Step 1: check if your host has an IPv6 address for you (hosting panel or support ticket). Step 2: in the DNS panel create an AAAA record pointing to that IPv6. Step 3: test.

✓ How to verify it works: dig AAAA your-domain.com — or online https://ipv6-test.com/validate.php?url=your-domain.com.

SPF record present: v=spf1 include:_spf-eu.ionos.com ~all — protects against email spoofing.

DMARC record present: v=DMARC1; p=none; — email authentication active.

100 Security Contact (security.txt)

security.txt found: https://more-eyes.de/.well-known/security.txt

Contact field present (required) — security researchers can report vulnerabilities.

Expires field present (required).

Preferred languages specified.

100 External Reporting Endpoints

No external reporting endpoints detected.

80 Cookie Consent

No consent banner needed — no trackers or third-party cookies detected.

100 Privacy Policy & Legal Notice

Legal notice linked: "Legal Notice" (/impressum/).

HTTP Response Headers

Header	Value
connection	keep-alive
content-encoding	gzip
content-security-policy	default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
content-type	text/html
cross-origin-opener-policy	same-origin
date	Wed, 04 Nov 2026 17:09:16 GMT
etag	W/"6aeb615b-403c"
last-modified	Wed, 04 Nov 2026 16:46:19 GMT
permissions-policy	camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()
referrer-policy	strict-origin-when-cross-origin
server	nginx/1.24.0 (Ubuntu)
strict-transport-security	max-age=31536000; includeSubDomains
transfer-encoding	chunked
x-content-type-options	nosniff
x-frame-options	DENY

New Scan · Compare

Embed your score on your website

Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).

HTML code to embed (this specific scan)

<a href="https://webforensik.de/results.php?id=4074" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?id=4074" alt="WebForensik Score" width="174" height="28">
</a>

Or dynamically — always shows the latest scan of this domain

<a href="https://webforensik.de/?url=https://more-eyes.de" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?domain=more-eyes.de" alt="WebForensik Score" width="174" height="28">
</a>