WebForensik
Results for https://www.mba-worldwide.com/
Scan time: 2026-11-04 23:32:16
Overall Score
Score history for this domain View full history →
✔ This website meets basic data protection requirements.
Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.
↓ See detailed results for each category below.
The website uses an encrypted connection (HTTPS).
Latest encryption active (TLS 1.3 — TLSv1.3).
The security certificate is valid (expires 2026-12-24).
Adequate encryption method (TLS_AES_128_GCM_SHA256, 128 bit).
HSTS is enabled — the browser is instructed to always use the encrypted connection.
HSTS duration: 31536000 seconds (at least 1 year) — very good.
HSTS also applies to all subdomains (includeSubDomains).
Content Security Policy present (via Meta-Tag).
Inline scripts allowed (unsafe-inline). Weakens XSS protection for inline code; the other CSP directives still protect.⚠ Mandatory when running WORDPRESS — required by WordPress itself.
▸ How to fix this — step-by-step guide
Your CSP allows "unsafe-inline" for scripts — this largely defeats XSS protection. Solution: sign inline scripts with a nonce or hash instead of allowing them wholesale. This is technically demanding — a job for your web developer.
WordPress Special for WordPress: where to add this
WordPress plugin: WordPress themes often emit inline scripts via wp_localize_script() or plugin output. Pragmatic interim step: keep "unsafe-inline" for now, but gradually externalize inline scripts to .js files. Pro solution: plugin "WP Content Security Policy & Headers" with nonce support.
✓ How to verify it works: Once nonce-based CSP is active: F12 → Console — no more "Refused to execute inline script…" messages.
Good base rule: only own content is allowed by default (default-src: self).
Referrer-Policy: strict-origin-when-cross-origin (via Meta-Tag).
Strict setting "strict-origin-when-cross-origin" — no path leak, no HTTP downgrade leak. Best practice.
MIME type protection active (nosniff) — browsers will not misinterpret files.
Clickjacking protection active: X-Frame-Options = SAMEORIGIN.
Permissions-Policy is configured — access to sensitive device APIs is controlled.
5 of 6 sensitive APIs restricted — very good.
No cookies set — exemplary for privacy.
No local storage (Web Storage) used — no tracking risk.
32 request(s) to 5 different third-party servers.
5 third-party server(s) within the EU/EEA.
Requested URLs:
https://zityad.com/biz_css/mba/js/jquery-3.7.1.min.js
https://zityad.com/biz_css/mba/js/aos.css
https://zityad.com/biz_css/mba/js/swiper-bundle.min.css
https://zityad.com/biz_css/mba/forms.css
https://zityad.com/biz_css/mba/mila-wall.css
https://zityad.com/biz_css/mba/template.css
https://zityad.com/biz_css/mba/tailwind.css?v=2
https://zityad.com/biz_css/mba/js/aos.js
https://zityad.com/biz_css/mba/mila-wall.js
https://zityad.com/biz_css/mba/js/cdn.min.js
https://zityad.com/biz_css/mba/fonts/IBMPlexSansVar-latin.woff2
https://zityad.com/biz_css/tailwing/app_js.js
https://zityad.com/biz_css/mba/fonts/IBMPlexSansVar-latin-ext.woff2
Requested URLs:
https://account.bcs.tools/form-widget/app.js
https://account.bcs.tools/ai-assistant/style.css
https://account.bcs.tools/ai-assistant/app.js
https://account.bcs.tools/form-widget/app.css
https://account.bcs.tools/api/v1/public/forms/2432
https://account.bcs.tools/api/v1/adscampaigns/visit
https://account.bcs.tools/api/v1/public/forms/2433
... and 1 more request(s)
Requested URLs:
https://www.zityad.com/ccm19/ccm19/public/app.js?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059
https://www.zityad.com/ccm19/ccm19/public/app.css?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059&gen=2&theme=faaea5e&v=1793809772
https://www.zityad.com/ccm19/ccm19/public/widget?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059&gen=2&theme=faaea5e&lang=de_DE&v=1793809772
https://www.zityad.com/ccm19/ccm19/public/cron?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059&gen=2&theme=faaea5e
https://www.zityad.com/ccm19/ccm19/public/statistics/consent?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059&gen=2&theme=faaea5e
https://www.zityad.com/ccm19/ccm19/public/widget/details?apiKey=8aa763fa14fcb3b4660d389a3bccaa492da3a607b94f0f04&domain=1ec1059&gen=2&theme=faaea5e&lang=de_DE&v=1793809772
... and 1 more request(s)
Requested URLs:
https://crm.biz24.online/form-widget/app.js
https://crm.biz24.online/api/v1/adscampaigns/hit?Url=https%3A%2F%2Fwww.mba-worldwide.com%2F&PageId=24032528&ProductId=null&AdsCampaignId=null&username=null
... and 1 more request(s)
Requested URLs:
https://biz24.online/image/1047512/cookietool.png
No known trackers detected.
0 of 20 external resource(s) use integrity verification (SRI).
▸ How to fix this — step-by-step guide
Only some of your external resources (0 of 20) are protected by SRI. Add integrity attributes to the remaining ones too.
WordPress Special for WordPress: where to add this
WordPress plugin: Approach: view page source → all <script src="https://…"> and <link href="https://…"> without integrity attribute → generate hash at https://www.srihash.org/ → add integrity="sha384-…" crossorigin="anonymous". Plugin "WP-SRI" automates many cases.
✓ How to verify it works: F12 → Console on page load: no "Failed to find a valid digest" messages. Source: all external <script>/<link> have an integrity attribute.
No external resources use integrity verification. Tampered files would not be detected.
▸ How to fix this — step-by-step guide
SRI (Subresource Integrity) is a checksum in HTML that defines what an externally loaded file MUST look like. If someone tampers with the external file (e.g. a CDN gets compromised), the browser refuses to load it. You add the "integrity" attribute on the script/link tag.
WordPress Special for WordPress: where to add this
WordPress plugin: In WordPress you can rarely add SRI hashes manually (scripts are queued via wp_enqueue_script()). Plugin "WP-SRI" (in the plugin directory) adds integrity hashes automatically for external scripts/styles. For statically embedded resources in your theme: generate the hash at https://www.srihash.org/, add integrity="sha384-…" and crossorigin="anonymous" on the <script>/<link> tag.
✓ How to verify it works: F12 → Network → requests with status 200 from CDN domains (cdn.jsdelivr.net, cdnjs.cloudflare.com etc.) → in HTML source the tag must contain "integrity=\"sha384-…\" crossorigin=\"anonymous\"".
No CAA records. Any certificate authority could issue a certificate for this domain.
▸ How to fix this — step-by-step guide
CAA records (Certification Authority Authorization) define in DNS which Certificate Authorities are allowed to issue certificates for your domain. Without a CAA record an attacker could request a fraudulent certificate for your domain at any CA. CAA is pure DNS configuration — set in your registrar/DNS-panel, NOT in WordPress.
☞ Concrete CAA values for the ten most common DACH-region hosts
Find your host in the table, copy the values to your DNS panel. For multi-CA hosts: one separate CAA record per CA (all with tag issue, flag 0, name @). Additionally recommended: an iodef record with a contact email for abuse reports.
| # | Host | CA(s) used | CAA value(s) — tag issue |
|---|---|---|---|
| 1 | Hetzner Webhosting (basic certificate, free in package) | DigiCert (programme „Encryption Everywhere") | digicert.com |
| 1 | Hetzner Webhosting (Let’s Encrypt, free) | Let’s Encrypt (ISRG) | letsencrypt.org |
| 2 | All-Inkl | Let’s Encrypt + Sectigo (Pro) | letsencrypt.orgsectigo.com |
| 3 | IONOS (1&1) | DigiCert (GeoTrust) + Let’s Encrypt | digicert.comletsencrypt.org |
| 4 | STRATO | Sectigo + Let’s Encrypt | sectigo.comletsencrypt.org |
| 5 | Cloudflare (Universal SSL) | Google Trust Services + DigiCert + Let’s Encrypt | pki.googdigicert.comletsencrypt.org |
| 6 | AWS (ACM / CloudFront) | Amazon Trust Services | amazon.comamazontrust.comawstrust.comamazonaws.com |
| 7 | Mittwald | Let’s Encrypt + Sectigo | letsencrypt.orgsectigo.com |
| 8 | Webgo | Let’s Encrypt + Sectigo | letsencrypt.orgsectigo.com |
| 9 | raidboxes (Managed WordPress) | Let’s Encrypt | letsencrypt.org |
| 10 | Host Europe / DomainFactory | Sectigo + Let’s Encrypt | sectigo.comletsencrypt.org |
Name Type Flag Tag Value
@ CAA 0 issue "digicert.com"
@ CAA 0 issue "letsencrypt.org"
@ CAA 0 iodef "mailto:security@your-domain.com"The iodef line (last line) is optional but recommended: CAs report abuse attempts to that address. For subdomains (e.g. shop.your-domain.com) create separate records with the subdomain name instead of @ — modern CAs check parent CAA automatically though.
If your host is not on the list: open your current certificate in the browser (padlock → certificate → issuer). The CA name is shown there (e.g. "Sectigo RSA Domain Validation Secure Server CA" → value sectigo.com). Add that as a CAA record, done.
WordPress Special for WordPress: where to add this
WordPress plugin: CAA records are NOT created in WordPress but in your domain registrar / DNS provider panel (e.g. Hetzner-Robot, IONOS Domains, Cloudflare Dashboard, INWX, etc.). Common label: "CAA record" or under "TXT records" with type selector "CAA". One separate record per CA.
✓ How to verify it works: On https://www.ssllabs.com/ssltest/analyze.html?d=your-domain.com → "DNS CAA" section → all your CAs should be listed. Or via dig: dig CAA your-domain.com.
No IPv6 support (no AAAA record).
▸ How to fix this — step-by-step guide
Your domain has no IPv6 address (AAAA record). Over 40% of users (especially mobile) reach the internet via IPv6 — they must take the slower IPv4 gateway detour.
WordPress Special for WordPress: where to add this
WordPress plugin: Pure DNS + server matter. Step 1: check if your host has an IPv6 address for you (hosting panel or support ticket). Step 2: in the DNS panel create an AAAA record pointing to that IPv6. Step 3: test.
✓ How to verify it works: dig AAAA your-domain.com — or online https://ipv6-test.com/validate.php?url=your-domain.com.
No SPF record. Emails can be forged in the name of this domain.
▸ How to fix this — step-by-step guide
SPF (Sender Policy Framework) defines in DNS which servers may send emails on behalf of your domain. Without SPF any phisher can spoof emails from you — and recipients are more likely to fall for them.
WordPress Special for WordPress: where to add this
WordPress plugin: DNS matter, not WordPress. Create a TXT record in your DNS panel. Examples: If you send NO emails: v=spf1 -all (reject all senders). If only your host sends: v=spf1 a mx ~all. If Google Workspace: v=spf1 include:_spf.google.com ~all. If Microsoft 365: v=spf1 include:spf.protection.outlook.com -all.
✓ How to verify it works: dig TXT your-domain.com | grep spf — or online https://www.kitterman.com/spf/validate.html.
No DMARC record. The domain is vulnerable to email phishing.
▸ How to fix this — step-by-step guide
DMARC combines SPF and DKIM into an explicit instruction for receiving mail servers: "What to do if emails claim to come from us but SPF/DKIM fail?" Without DMARC each server decides — usually generously. With DMARC=reject you effectively prevent phishing in your name.
WordPress Special for WordPress: where to add this
WordPress plugin: DNS matter. TXT record at subdomain _dmarc.your-domain.com. Recommended stages: Observe first: v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com — review reports for weeks. Then tighten: v=DMARC1; p=quarantine; rua=… — suspicious mails go to spam. Final: v=DMARC1; p=reject; rua=… — they’re refused outright.
✓ How to verify it works: dig TXT _dmarc.your-domain.com — or online https://dmarcian.com/dmarc-inspector/.
security.txt found: https://www.mba-worldwide.com/.well-known/security.txt
Contact field present (required) — security researchers can report vulnerabilities.
Expires field present (required).
Preferred languages specified.
No external reporting endpoints detected.
No consent banner needed — no trackers or third-party cookies detected.
Privacy policy linked: "https://www.mba-worldwide.com/datenschutz" (https://www.mba-worldwide.com/datenschutz).
Legal notice linked: "Impressum" (https://www.mba-worldwide.com/impressum).
Privacy policy page is accessible (HTTP 200).
⚙ Your ready-to-use security .htaccess
All missing security headers combined into one block. Append this block to the end of your .htaccess — done. 1 headers will be set.
⚠ Why this recommendation does NOT give a 100% score — and why that's how it is with WordPress
The Content-Security-Policy above deliberately includes 'unsafe-inline' for both style-src and script-src. This does NOT provide full XSS protection — it's a pragmatic trade-off, not a bug.
Why? A typical WordPress setup (theme + 5-15 plugins) emits 10-50 different inline <script> blocks into the HTML: jQuery init, slider init, cookie banner, tracking, GTM, web vitals, lazy-load, speculation rules and so on. A strict script-src 'self' blocks them all — the site becomes visually and functionally broken (blank slider, broken cookie banner, dead plugins).
Consequence for scoring: Sites running WordPress with plugins can score at most ~75-85 points in the CSP category in this app — the full 100% rating is only achievable when inline code is signed via nonce or hash (technically demanding, breaks on every theme/plugin update).
Paths to full XSS protection (in increasing complexity):
- Plugin "WP Content Security Policy & Headers" — automatically adds nonces to inline scripts (medium effort, cleanest WP solution).
- Hash-based CSP — whitelist every inline script via SHA-256 in the CSP (fragile, breaks on updates).
- Externalize inline scripts — rebuild theme/plugins so no inline JS is emitted (huge effort, often impossible).
Anyone who doesn't take one of these paths lives with 'unsafe-inline' — like about 95% of all production WordPress sites on the web. The other CSP directives still protect: default-src 'self' blocks external resources, object-src 'none' bans Flash/Java, frame-ancestors 'self' prevents clickjacking, base-uri 'self' prevents base-tag hijacking. Not maximum protection, but realistic protection for WP reality.
Apache Standard Apache (any host, without WordPress)
Append this block to the end of your .htaccess in the web root — done.
<IfModule mod_headers.c>
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
</IfModule>WordPress WordPress: .htaccess in WP root
Insert this block ABOVE the "# BEGIN WordPress" line, otherwise WP overwrites it on permalink changes.
# BEGIN WebForensik Security
<IfModule mod_headers.c>
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
</IfModule>
# END WebForensik SecurityWordPress Alternative for WordPress: functions.php in child theme
If your host disallows .htaccess changes: append this PHP snippet to the end of your CHILD theme's functions.php. Back up first — NEVER edit the parent theme, it gets overwritten on updates.
add_action('send_headers', function () {
header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests");
});| Header | Value |
|---|---|
| access-control-allow-methods | GET,POST,PUT,DELETE,OPTIONS |
| access-control-allow-origin | * |
| alt-svc | h3=":443"; ma=2592000 |
| cache-control | no-cache |
| content-encoding | gzip |
| content-length | 32113 |
| content-type | text/html; charset=UTF-8 |
| date | Wed, 04 Nov 2026 22:32:11 GMT |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| server | Caddy Apache/2.4.25 (Debian) |
| strict-transport-security | max-age=31536000; includeSubDomains |
| vary | Accept-Encoding |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
Embed your score on your website
Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).
HTML code to embed (this specific scan)
<a href="https://webforensik.de/results.php?id=4095" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?id=4095" alt="WebForensik Score" width="174" height="28">
</a>Or dynamically — always shows the latest scan of this domain
<a href="https://webforensik.de/?url=https://mba-worldwide.com" target="_blank" rel="noopener">
<img src="https://webforensik.de/badge.php?domain=mba-worldwide.com" alt="WebForensik Score" width="174" height="28">
</a>