WebForensik

Results for https://www.aeris.de/

Scan time: 2026-11-05 02:06:52

Overall Score

GDPR Summary

⚠ This website has serious GDPR deficiencies. Immediate action is required.

GDPR Issues Detected (4):

❌ 15 third-party server(s) outside the EU/EEA — data transfers without legal basis may violate Art. 44–49 GDPR.

Affected servers outside the EU:

code.jquery.com (United States)
bat.bing.com (United States)
www.googletagmanager.com (United States)
otlp-http-production.shopifysvc.com (United States)
interfaces.zapier.com (United States)
bat.bing.net (United States)
forms.shopifyapps.com (United States)
pagead2.googlesyndication.com (United States)
region1.google-analytics.com (United States)
dr4qe3ddw9y32.cloudfront.net (United States)
cdn.hextom.com (United States)
qab.hextom.com (United States)
insight.adsrvr.org (United States)
trc-events.taboola.com (Singapore)
extensions.shopifycdn.com (United States)

❌ 3 tracking service(s) detected — without prior consent (opt-in) this violates Art. 6(1) GDPR.

Detected trackers:

Shopify (Content)
Volentio JSD (Content)
Microsoft (Advertising)

⚠ Third-party cookies are being set — without consent this violates the ePrivacy Directive.

⚠ Missing or unsafe Referrer-Policy — URLs containing personal data may be leaked to third parties.

Note: This automated analysis does not replace legal advice. For a complete GDPR assessment, consult a data protection officer.

↓ See detailed results for each category below.

100 HTTPS / Encryption

The website uses an encrypted connection (HTTPS).

Latest encryption active (TLS 1.3 — TLSv1.3).

The security certificate is valid (expires 2026-12-27).

Strong encryption method (TLS_AES_256_GCM_SHA384, 256 bit).

50 Enforced Encryption (HSTS)

HSTS is enabled — the browser is instructed to always use the encrypted connection.

HSTS duration: only 7889238 seconds — too short. At least 180 days recommended.

☛ Action needed: The HSTS duration is too short. Increase max-age to at least 15552000 (180 days), ideally 31536000 (1 year).

▸ How to fix this — step-by-step guide

Your HSTS max-age is too short (only 7889238 seconds) — browsers "forget" the HTTPS requirement quickly. Recommended: at least 180 days (15552000 seconds), preferably 1 year (31536000).

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

⚠ If another Strict-Transport-Security entry exists, replace it (don’t add a second one — only the first takes effect).

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

⚠ Replace the existing HSTS entry in .htaccess with this line.

✓ How to verify it works: curl -I https://your-domain.com | grep -i strict — max-age must be at least 15552000.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

40 Content Security Policy (CSP)

Content Security Policy present (via HTTP-Header).

No restriction for scripts defined (script-src/default-src missing).

☛ Action needed: Add a script-src directive to your Content Security Policy to define where scripts may be loaded from. Example: script-src 'self'

▸ How to fix this — step-by-step guide

Your CSP exists but has no script-src — meaning scripts are unrestricted. Scripts are the most common XSS vector. Add script-src together with the other essential directives.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

⚠ Replace the existing CSP line (do not add a second one). This policy is deliberately pragmatic — it allows inline styles and data: URIs for images because almost all themes (especially WordPress!) need this. If you use external scripts (CDN), append the domain to script-src: script-src 'self' https://cdn.example.com. For maximum security later, gradually tighten style-src to 'self' and verify in the browser (F12 → Console) that no inline-style violations appear.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

⚠ Replace the existing CSP. IMPORTANT for WordPress: img-src with data: enables emoji + admin-bar SVGs, style-src 'unsafe-inline' allows the many inline styles from themes and plugins — without both, the site will break visually. Common WP script sources to add to script-src: 'self' (own), https://www.googletagmanager.com (GTM), https://www.google-analytics.com (GA) — append after 'self' with a space.

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme

add_action('send_headers', function () {
    header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'");
});

⚠ Watch out for existing send_headers hooks — keep only one active. Back up functions.php before editing!

✓ How to verify it works: F12 → Network → Response Header content-security-policy contains "script-src 'self'". Console: no script blocks, no "Refused to load…" messages.

Embedding protection (frame-ancestors) is configured — protects against clickjacking.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

0 Referrer Policy

No Referrer-Policy set. When clicking external links, the full page URL is shared with other websites.

☛ Action needed: Set a Referrer-Policy to prevent the full URL of your pages from being shared with external websites. GDPR-relevant: URLs can contain personal data (e.g., usernames, search terms). Recommended setting: Referrer-Policy: strict-origin-when-cross-origin

▸ How to fix this — step-by-step guide

Without a Referrer-Policy the browser sends the full URL of your current page (incl. search terms, usernames in URL params) on every click to the destination site. Privacy-relevant per Art. 5 GDPR. Recommended safe setting: strict-origin-when-cross-origin.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

⚠ "strict-origin-when-cross-origin" is the modern standard: on cross-domain clicks only your origin (no path/params) is sent — internal clicks include the full URL. Stricter is "no-referrer" (send nothing) but it breaks some analytics tools.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

⚠ WordPress 4.9+ already emits a meta-tag with this policy, but the HTTP header above applies to all resources (images, scripts) — not only the HTML document.

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme

add_action('send_headers', function () {
    header('Referrer-Policy: strict-origin-when-cross-origin');
});

⚠ Always back up functions.php before edits.

✓ How to verify it works: F12 → Network → first request → Response Headers — "referrer-policy: strict-origin-when-cross-origin" must be present.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

100 MIME Type Protection

MIME type protection active (nosniff) — browsers will not misinterpret files.

100 Clickjacking Protection

Clickjacking protection active via CSP frame-ancestors.

0 Permissions (Camera, Microphone, etc.)

No Permissions-Policy set. Third-party scripts could access camera, microphone, or location.

☛ Action needed: Set a Permissions-Policy to control access to camera, microphone, and location. GDPR-relevant: Without this setting, third-party scripts could silently access sensitive device features. Example: Permissions-Policy: camera=(), microphone=(), geolocation=()

▸ How to fix this — step-by-step guide

Permissions-Policy controls whether scripts (including third-party) may access camera, microphone, location, motion sensors etc. GDPR-relevant because sensitive device APIs can otherwise be reached unnoticed.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()"
</IfModule>

⚠ "()" at the end means: no caller (not even your own page) may use this API. If you need geolocation (e.g. a map feature): use geolocation=(self) instead of geolocation=(). "interest-cohort=()" disables Google’s FLoC tracking.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()"
</IfModule>

⚠ Standard WordPress needs none of these APIs. If you use a plugin that needs the camera (QR scanner, video upload), set that API to "(self)".

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme

add_action('send_headers', function () {
    header('Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()');
});

⚠ Back up functions.php before edits.

✓ How to verify it works: F12 → Network → Response Header: "permissions-policy" visible.

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

35 Cookies

10 first-party and 7 third-party cookie(s).

7 third-party cookie(s) detected. These can be used to track you across different websites.

☛ Action needed: GDPR VIOLATION: Third-party cookies track visitors across multiple websites. This requires explicit consent (opt-in) BEFORE the cookies are set. Solution: (1) Check which external services set the cookies. (2) Remove unnecessary services. (3) For essential services: Implement a cookie consent banner that only loads these cookies after consent.

▸ How to fix this — step-by-step guide

Third-party cookies (e.g. from Google, Facebook) track visitors across websites. Under GDPR Art. 6 and ePrivacy / national implementations, explicit consent is required BEFORE setting them. Three-step fix: (1) identify which external services set the cookies, (2) remove services you don’t strictly need, (3) for essential services, add a consent banner that loads them only after "Accept".

WordPress Special for WordPress: where to add this

WordPress plugin: Cookie-consent plugins for WordPress: "Complianz" (free, GDPR-focused, thorough wizard), "Real Cookie Banner" (free, knows many services), "Borlabs Cookie" (paid, most feature-complete). Critical configuration: set all tracking services to "do NOT load before consent" — most plugins detect standard services (GA, Maps, YouTube) automatically.

✓ How to verify it works: Open the site in incognito mode → F12 → Application → Cookies → your-domain.com. BEFORE clicking "Accept" there must be NO cookies from google.com, facebook.com etc. AFTER consent, yes.

7 of 17 cookie(s) without Secure flag — sent over unencrypted connections too.

☛ Action needed: Set the Secure flag for all cookies. Without it, cookies are also sent over unencrypted HTTP connections and can be intercepted. Your web developer can change this in the cookie configuration.

▸ How to fix this — step-by-step guide

Cookies without the "Secure" flag are also sent over unencrypted HTTP — and can be intercepted by anyone on the same WLAN. There’s no reason to omit Secure on HTTPS-only sites.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; Secure" "expr=!(resp('Set-Cookie') -strmatch '*Secure*')"
</IfModule>

⚠ This header appends "; Secure" to cookies that don’t have it yet. Requires Apache 2.4+. The cleaner fix is to correct the code that sets the cookie (PHP: session.cookie_secure=1 in php.ini, or setcookie() with "secure" => true).

WordPress Special for WordPress: where to add this

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme

add_filter('secure_logged_in_cookie', '__return_true');
add_action('init', function () {
    if (!headers_sent()) {
        @ini_set('session.cookie_secure', '1');
        @ini_set('session.cookie_httponly', '1');
        @ini_set('session.cookie_samesite', 'Lax');
    }
});

⚠ Sets the Secure flag for WordPress login cookies and PHP session cookies. Plugins that set their own cookies must be configured separately (check plugin settings).

WordPress plugin: Plugins that set cookies (cache, anti-spam, A/B testing) often have toggles like "Secure cookies" or "HTTPS only" in their settings.

✓ How to verify it works: F12 → Application → Cookies → your-domain.com. The "Secure" column should show a checkmark for every cookie.

14 of 17 cookie(s) without HttpOnly flag — could be read by malicious code.

☛ Action needed: Set the HttpOnly flag for all cookies that are not needed by JavaScript. This protects against session data theft through malicious code.

▸ How to fix this — step-by-step guide

Cookies without the "HttpOnly" flag can be read by JavaScript — an XSS attacker can steal session cookies and impersonate the logged-in user. Set HttpOnly for all cookies JavaScript doesn’t actively need.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; HttpOnly" "expr=!(resp('Set-Cookie') -strmatch '*HttpOnly*')"
</IfModule>

⚠ Cleaner: set cookies with HttpOnly directly (PHP: setcookie(..., [..., 'httponly'=>true])). Exception: cookies that JS actively reads (e.g. some consent cookies).

WordPress Special for WordPress: where to add this

Option 2: via functions.php in the child theme (Advanced alternative)

File: functions.php of your CHILD theme (or better wp-config.php)

@ini_set('session.cookie_httponly', '1');
@ini_set('session.cookie_secure', '1');

⚠ WordPress login cookies have been HttpOnly since 2.x. If you use a plugin that sets session cookies (e.g. WooCommerce cart pre-login), check its settings.

✓ How to verify it works: F12 → Application → Cookies → "HttpOnly" column shows checkmarks everywhere (except for deliberately JS-readable cookies like the consent cookie).

11 of 17 cookie(s) without SameSite protection — sent with requests from other websites.

☛ Action needed: Set the SameSite attribute (Lax or Strict) for all cookies. This prevents cookies from being sent with requests from other websites (CSRF protection).

▸ How to fix this — step-by-step guide

Without "SameSite" cookies are sent on requests from foreign sites — the basis of CSRF attacks (a foreign page silently triggers actions in your name because the login cookie travels along). Set SameSite=Lax as a minimum.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>

⚠ SameSite=Lax is a good default. Strict is safer but breaks external links (user clicks from Google to your site — cookies are NOT sent, login is lost). None allows cross-site but requires "; Secure".

WordPress Special for WordPress: where to add this

Option 2: via functions.php in the child theme (Advanced alternative)

File: wp-config.php (above "/* That’s all, stop editing! */")

@ini_set('session.cookie_samesite', 'Lax');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');

⚠ Sets SameSite/Secure/HttpOnly for PHP session cookies. WordPress login cookies have been SameSite=Lax since WP 6.2. Update older versions!

✓ How to verify it works: F12 → Application → Cookies → "SameSite" column should show "Lax" or "Strict" everywhere, not empty.

First-party cookies (from the website itself)

Name	Domain	Encrypted	Server only	SameSite
_shopify_essential	aeris.de	Yes	Yes	Lax
_shopify_essential	www.aeris.de	Yes	Yes	Lax
localization	www.aeris.de	No	No	Lax
cart_currency	www.aeris.de	No	No	Lax
_uetmsdns	www.aeris.de	Yes	No	Strict
_pandectes_gdpr	.www.aeris.de	No	No	Lax
_tt_enable_cookie	.aeris.de	No	No	None
_ttp	.aeris.de	No	No	None
ttcsid	.aeris.de	No	No	None
ttcsid_D2MNRGJC77U7BITDITQ0	.aeris.de	No	No	None

Third-party cookies (from external services)

Name	Domain	Encrypted	Server only	SameSite
_ttp	.tiktok.com	Yes	No	None
bcookie	.linkedin.com	Yes	No	None
li_gc	.linkedin.com	Yes	No	None
lidc	.linkedin.com	Yes	No	None
__cf_bm	.linkedin.com	Yes	Yes	None
u8x7eovwf3h6_uid	.ad-srv.net	Yes	No	None
jg2kf3qb0kis_uid	.ad-srv.net	Yes	No	None

↓ SHOW COMPLETE SOLUTION All missing security headers bundled at the end of the report — ready to copy.

50 Local Storage (Web Storage)

7 localStorage and 8 sessionStorage item(s) found.

Extensive localStorage usage — may indicate tracking or fingerprinting.

☛ Action needed: Extensive localStorage usage may indicate tracking or fingerprinting. Check what data is stored and whether it is necessary for the website to function. GDPR-relevant: localStorage data can also fall under the ePrivacy Directive.

▸ How to fix this — step-by-step guide

Heavy use of localStorage may indicate tracking or fingerprinting (localStorage isn’t covered by cookie consent but can identify visitors). Check whether the data is actually needed — and if yes, mention it in your privacy policy.

WordPress Special for WordPress: where to add this

WordPress plugin: localStorage usage usually originates from themes or plugins (cookie banner state, cart, A/B testing, slider position). Approach: F12 → Application → Local Storage → your-domain.com — review entries, identify the likely culprit (plugin name in the key), check the plugin settings or remove the plugin if not needed.

✓ How to verify it works: Incognito browser → load page once → F12 → Application → Local Storage — as few entries as possible, none without a clear functional purpose.

localStorage

Name	Value
forms_session_id	9dc4259b-7b4e-4257-aa74-3c564eb6f58f
eng_mt	{"ver":36,"sessionStartTime":1793840800499,"scrollDepth":0,"sessionDepth":["-183
forms_session_expires_at	1793842600712
forms_visit_count	1
forms_previous_session_id	9dc4259b-7b4e-4257-aa74-3c564eb6f58f
qab_render_beaconed	1795050401424
vsai	bu+B+1ScFuNaxEJ4b7YvejzB33zXzrFUdm7r0uUnfYBqAIgaZYICSsA8P0JGxOtrmkAyMFJ4Sg0BCh3m

sessionStorage

Name	Value
consentHeader	3.ampS_DE_t_f_75*ffFKKR9Ca9gHrdxuXKg
_shs_state	{"wd":true,"ua":false,"cf":true,"be":true,"nm":false,"nc":false,"ka":false,"sa":
tt_appInfo	{"platform":"pc"}
qab_payload	{"shop_active":"yes","record":true,"bars":[{"bar_id":262267,"updated_on":"2025-0
tt_sessionId	"287f9886-d8b5-11f1-a67a-064693b1cc49::GlIFJWvBfrbKCZ_FlS0o"
tt_pixel_session_index	{"index":0,"main":0}
orbeSession	{"meta":{"fromCache":false,"ip":"2a01:4f8:d0a:3163::2","path":"/api/v1/geolocati
qab_previous_pathname	/

10 Third-Party Requests

117 request(s) to 31 different third-party servers.

15 third-party server(s) outside the EU/EEA — potentially problematic for GDPR compliance.

☛ Action needed: POSSIBLE GDPR VIOLATION: Your visitors' data is being transferred to servers outside the EU/EEA. Since the Schrems II ruling, this is only permitted with special safeguards. Solutions: (1) Switch to EU-based alternatives (e.g., Matomo instead of Google Analytics, Bunny Fonts instead of Google Fonts). (2) If not possible: Ensure Standard Contractual Clauses (SCC) and additional technical measures are in place. (3) Obtain explicit visitor consent BEFORE data is transferred.

▸ How to fix this — step-by-step guide

GDPR-relevant: visitor data (at least IP + User-Agent) is transmitted to servers outside the EU/EEA. Since the Schrems-II ruling (2020) this requires Standard Contractual Clauses + supplementary technical measures AND prior consent. Best fix: replace with EU alternatives where possible.

WordPress Special for WordPress: where to add this

WordPress plugin: Common culprits and EU alternatives: Google Fonts → Bunny Fonts or self-host (plugin "OMGF — Host Google Fonts Locally"). Google Analytics → Matomo (self-hosted) or Plausible (EU servers). Google reCAPTCHA → hCaptcha (EU) or Friendly Captcha. Google Maps → OpenStreetMap. YouTube embeds → plugin "WP YouTube Lyte" loads only after click. CDN: Cloudflare → BunnyCDN (EU) or KeyCDN.

✓ How to verify it works: Load in incognito mode, F12 → Network → list all requests → check "Domain" column for non-EU servers. After migration no unrequested US domains should load.

16 third-party server(s) within the EU/EEA.

cdn.shopify.com 43 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://cdn.shopify.com/extensions/01a1a718-384c-7f7e-b1fd-368042f5de6b/orbe-geolocation-512/assets/md-app-modal.min.css

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/loader.init-shop-cart-sync.de.esm.js

https://cdn.shopify.com/storefront/standard-actions.js

https://cdn.shopify.com/s/files/1/0357/6833/6519/files/swopper-gleiter-schwarz-gravur.jpg?v=1667323763

https://cdn.shopify.com/extensions/01a18372-86d7-70ce-9a30-6e144651d0a7/agentic-ai-search-discovery-92/assets/vision-search.min.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/client.init-shop-cart-sync_CIil05Dh.de.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.window_CAbVMZox.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.init_CNFr0A29.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.document_DMcRsBXN.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.networkErrorMessages_Du380vAr.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.register_BoetXJ5o.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.defineInitFunction_CIjOjzsO.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.casing_U_9x-Om3.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.utils_K8y2k-BJ.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.useUserRecognitionSignal_Be-LX1VX.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.storage_DQF5v-OM.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/client.shop-cart-sync_BDC2DLit.de.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.v4_C3N_0s0v.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.hooks_NQw5b9qv.esm.js

https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/chunk.validators_09U1U9sZ.esm.js

... and 23 more request(s)

analytics.tiktok.com 17 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=D2MNRGJC77U7BITDITQ0&lib=ttq

https://analytics.tiktok.com/i18n/pixel/static/main.MWJhZThiYmZhMQ.js

https://analytics.tiktok.com/i18n/pixel/static/identify_3fd9fe73.js

https://analytics.tiktok.com/api/v2/monitor

https://analytics.tiktok.com/api/v2/pixel

https://analytics.tiktok.com/api/v2/pixel/act

... and 11 more request(s)

api.visionai.link 6 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://api.visionai.link/search/api/shops/00cd3f0a-b9bb-45c8-9f3a-58f3044a8f93/sales_channels/default/config

https://api.visionai.link/search/api/shops/00cd3f0a-b9bb-45c8-9f3a-58f3044a8f93/sales_channels/default/products/search?language=de&price_ctx=DE&currency=EUR&shop_system=shopify

https://api.visionai.link/search/api/shops/00cd3f0a-b9bb-45c8-9f3a-58f3044a8f93/sales_channels/default/translations

... and 3 more request(s)

otlp-http-production.shopifysvc.com 4 Requests · United States (US) · Non-EU

⚠ GDPR Issue: This server is located outside the EU/EEA. Transferring personal data (e.g. your visitors' IP addresses) to this server may violate Art. 44-49 GDPR. Without a valid legal basis (e.g. consent, Standard Contractual Clauses) this data transfer is unlawful.

Requested URLs:

https://otlp-http-production.shopifysvc.com/v1/metrics

... and 3 more request(s)

region1.google-analytics.com 4 Requests · United States (US) · Non-EU

Requested URLs:

https://region1.google-analytics.com/g/collect?v=2&tid=G-WB4MM6TJ3D&gtm=45je6b31v874832570za20ozb71724410zd71724410xf1&_p=1793840799852&gcs=G100&gcd=13p3pPp2p5l1&npa=1&dma_cps=-&dma=1&gdid=dMTZkMj.dN2

https://region1.google-analytics.com/g/collect?v=2&tid=G-WB4MM6TJ3D&gtm=45je6b31v874832570z871724410za20gzb71724410zd71724410xf1&_p=1793840799852&gcs=G100&gcd=13p3pPp2p5l1&npa=1&dma_cps=-&dma=1&gdid=d

https://region1.google-analytics.com/measurement/conversion?random=1793840800954&cv=11&tid=G-WB4MM6TJ3D&fst=1793840800954&fmt=8&en=Scroll%20%25%2075&gtm=45je6b31v874832570z871724410za20gzb71724410zd71

... and 1 more request(s)

ad.ad-srv.net 4 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://ad.ad-srv.net/retarget?a=88837&version=1

https://ad.ad-srv.net/retarget?a=88837&version=1&redirected=1

https://ad.ad-srv.net/dsp/retargeting/di832uru0rci/?gdpr=&gdpr_consent=

https://ad.ad-srv.net/dsp/retargeting/di832uru0rci/?gdpr=&gdpr_consent=&dspRetargetingMarkersetRedirected=1&

www.googletagmanager.com 3 Requests · United States (US) · Non-EU

Requested URLs:

https://www.googletagmanager.com/gtm.js?id=GTM-5S3VW9

https://www.googletagmanager.com/gtag/js?id=G-WB4MM6TJ3D&cx=c&gtm=4e6b31

https://www.googletagmanager.com/gtag/js?id=DC-12141533&cx=c&gtm=4e6b31

bat.bing.net 3 Requests · United States (US) · Non-EU

Requested URLs:

https://bat.bing.net/actionp/0?ti=134618422&Ver=2&mid=a8e7d18e-90e7-4125-8ac9-63853a7a7cd4&bo=1&evt=consent&src=default&cdb=AQAQ&asc=D

https://bat.bing.net/actionp/0?ti=134618422&Ver=2&mid=a8e7d18e-90e7-4125-8ac9-63853a7a7cd4&bo=2&evt=consent&src=default&cdb=AQAQ&asc=D

https://bat.bing.net/action/0?ti=134618422&Ver=2&mid=a8e7d18e-90e7-4125-8ac9-63853a7a7cd4&bo=3&pi=918639831&lg=en-US&sw=800&sh=600&sc=24&nwd=1&tl=Ergonomische%20B%C3%BCrost%C3%BChle%20von%20Aeris&p=ht

pagead2.googlesyndication.com 3 Requests · United States (US) · Non-EU

Requested URLs:

https://pagead2.googlesyndication.com/ccm/collect?rcb=19&frm=0&apvc=1&ae=g&en=page_view&dl=https%3A%2F%2Fwww.aeris.de&scrsrc=www.googletagmanager.com&rnd=855131166.1793840801&navt=n&npa=1&ep.ads_data_

https://pagead2.googlesyndication.com/ccm/collect?rcb=12&frm=0&apvc=0&tid=AW-455637472&en=page_view&dl=https%3A%2F%2Fwww.aeris.de&scrsrc=www.googletagmanager.com&rnd=855131166.1793840801&navt=n&npa=1&

https://pagead2.googlesyndication.com/ccm/collect?rcb=12&frm=0&apvc=0&tid=DC-12141533&en=page_view&dl=https%3A%2F%2Fwww.aeris.de&scrsrc=www.googletagmanager.com&rnd=855131166.1793840801&navt=n&npa=1&g

cdn.jsdelivr.net 2 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://cdn.jsdelivr.net/npm/swiper@8/swiper-bundle.min.js

https://cdn.jsdelivr.net/npm/alpinejs@3.13.3/dist/cdn.min.js

bat.bing.com 2 Requests · United States (US) · Non-EU

Requested URLs:

https://bat.bing.com/bat.js

https://bat.bing.com/p/action/134618422.js

interfaces.zapier.com 2 Requests · United States (US) · Non-EU

Requested URLs:

https://interfaces.zapier.com/assets/web-components/zapier-interfaces/zapier-interfaces.esm.js

https://interfaces.zapier.com/assets/web-components/zapier-interfaces/p-18b43768.js

forms.shopifyapps.com 2 Requests · United States (US) · Non-EU

Requested URLs:

https://forms.shopifyapps.com/api/v2/form_instances?shopify_domain=aeris-de.myshopify.com

... and 1 more request(s)

trc.taboola.com 2 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://trc.taboola.com/1726221/trc/3/json?tim=1793840800500&data=%7B%22id%22%3A950%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1793840800496%2C%22

https://trc.taboola.com/1726221/log/3/unip?it=GTM&en=view_content&tim=1793840800503&vi=1793840800496&ri=b930253a177838ecfcc18c9461d224ab&ref=null&cv=20261101-3-RELEASE&item-url=https%3A%2F%2Fwww.aeris

px.ads.linkedin.com 2 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1064577&time=1793840800495&pageLoadId=0019c1fa-afdd-44ba-b0c5-14eca80afe33&url=https%3A%2F%2Fwww.aeris.de%2F&tm=gtmv2

https://px.ads.linkedin.com/wa/?medium=fetch&fmt=g

tm714.ad-srv.net 2 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://tm714.ad-srv.net/tm/a/container/eval/cfb7b9a7e9.js?sid=mt7uing03odl0mkb28ac3ug41q&rnd=76283522&macroData[transactionId]=&macroData[searchTerm]=&macroData[products]=&macroData[productId]=empty&

https://tm714.ad-srv.net/tm/a/container/tags/iframe/cfb7b9a7e9.html?sid=mt7uing03odl0mkb28ac3ug41q

qab.hextom.com 2 Requests · United States (US) · Non-EU

Requested URLs:

https://qab.hextom.com/qab_get_bars?shop=aeris-de.myshopify.com

https://qab.hextom.com/qab_record_render?shop=aeris-de.myshopify.com

code.jquery.com 1 Requests · United States (US) · Non-EU

Requested URLs:

https://code.jquery.com/jquery-3.4.1.min.js

cdnjs.cloudflare.com 1 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://cdnjs.cloudflare.com/ajax/libs/shopify-cartjs/0.4.3/rivets-cart.min.js

snap.licdn.com 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://snap.licdn.com/li.lms-analytics/insight.min.js

cdn.taboola.com 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://cdn.taboola.com/libtrc/unip/1726221/tfa.js

aeris-de.myshopify.com 1 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://aeris-de.myshopify.com/cdn/shop/files/pandectes-reopen-logo.png

px4.ads.linkedin.com 1 Requests · Canada (CA) · EU/EEA

Requested URLs:

https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1064577&time=1793840800495&pageLoadId=0019c1fa-afdd-44ba-b0c5-14eca80afe33&url=https%3A%2F%2Fwww.aeris.de%2F&tm=gtmv2&e_ipv6=AQJ9HOAJbj7yAQAAAaGpPmN

dr4qe3ddw9y32.cloudfront.net 1 Requests · United States (US) · Non-EU

Requested URLs:

https://dr4qe3ddw9y32.cloudfront.net/awin-shopify-integration-code.js?aid=126403&v=shopifyApp_5.5.0&ts=1790772833070&shop=aeris-de.myshopify.com

analytics-ipv6.tiktokw.us 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://analytics-ipv6.tiktokw.us/ipv6/enrich_ipv6

cdn.hextom.com 1 Requests · United States (US) · Non-EU

Requested URLs:

https://cdn.hextom.com/js/quickannouncementbar.js?shop=aeris-de.myshopify.com

tm.ad-srv.net 1 Requests · Germany (DE) · EU/EEA

Requested URLs:

https://tm.ad-srv.net/tm/a/container/init/cfb7b9a7e9.js?ntmData=ntmData7108369710807&rnd=80628016

insight.adsrvr.org 1 Requests · United States (US) · Non-EU

Requested URLs:

https://insight.adsrvr.org/track/pxl/?adv=apca4a4&ct=0:4q1bqmx&fmt=3&gdpr=&gdpr_consent=

x.bidswitch.net 1 Requests · Netherlands (NL) · EU/EEA

Requested URLs:

https://x.bidswitch.net/sync?dsp_id=305&user_id=9739c697789f0264&expires=90&gdpr=&gdpr_consent=

trc-events.taboola.com 1 Requests · Singapore (SG) · Non-EU

Requested URLs:

https://trc-events.taboola.com/1726221/log/3/unip?en=pre_d_eng_tb&tos=4572&scd=0&ssd=1&est=1793840800499&ver=36&isls=true&src=i&invt=4500&msa=8364&rv=1&tim=1793840805071&vi=1793840800496&ri=b930253a17

extensions.shopifycdn.com 1 Requests · United States (US) · Non-EU

Requested URLs:

https://extensions.shopifycdn.com/shopifycloud/checkout-web/assets/c1/polyfills-entry-modern.qLDcQEZF.worker.js

40 Tracker Detection

3 known tracker(s) detected! These track visitors across different websites.

☛ Action needed: GDPR VIOLATION: Trackers follow your visitors across different websites. This requires explicit consent BEFORE loading the trackers. Solutions: (1) Remove all unnecessary trackers. (2) Switch to privacy-friendly alternatives (e.g., Matomo, Plausible, Fathom instead of Google Analytics). (3) For essential trackers: Implement a consent banner that only loads trackers AFTER consent.

▸ How to fix this — step-by-step guide

Trackers (Google Analytics, Facebook Pixel, …) capture visitors and follow them across multiple sites. Under GDPR Art. 6 and ePrivacy / national implementations, explicit consent is required BEFORE loading the tracker. "Continued scrolling = consent" is NOT acceptable.

WordPress Special for WordPress: where to add this

WordPress plugin: Consent plugins that properly block trackers until consent: "Complianz" (free, very good), "Real Cookie Banner", "Borlabs Cookie" (paid, most thorough). Principle after setup: do NOT embed the tracker snippet (e.g. GA script) directly in your theme — register it with the consent plugin, which only releases it after "Accept". Privacy-friendly tracker alternatives: Matomo (cookieless mode → may need no consent), Plausible (EU, anonymous, vendor claims no consent needed — legal advice recommended).

✓ How to verify it works: Incognito, load page — BEFORE "Accept": F12 → Network → no requests to google-analytics.com, facebook.com/tr etc. AFTER "Accept", yes.

Shopify (Content): cdn.shopify.com

Volentio JSD (Content): cdn.jsdelivr.net

Microsoft (Advertising): bat.bing.com

3 External Resource Integrity (SRI)

1 of 36 external resource(s) use integrity verification (SRI).

☛ Action needed: Not all external resources have integrity verification. Add SRI hashes for the missing resources.

▸ How to fix this — step-by-step guide

Only some of your external resources (1 of 36) are protected by SRI. Add integrity attributes to the remaining ones too.

WordPress Special for WordPress: where to add this

WordPress plugin: Approach: view page source → all <script src="https://…"> and <link href="https://…"> without integrity attribute → generate hash at https://www.srihash.org/ → add integrity="sha384-…" crossorigin="anonymous". Plugin "WP-SRI" automates many cases.

✓ How to verify it works: F12 → Console on page load: no "Failed to find a valid digest" messages. Source: all external <script>/<link> have an integrity attribute.

85 DNS Security

CAA records present: pki.goog, ssl.com, digicert.com, globalsign.com, letsencrypt.org — only specified certificate authorities may issue certificates.

IPv6 support present (AAAA records).

No SPF record. Emails can be forged in the name of this domain.

☛ Action needed: Create an SPF DNS record (TXT) to specify which servers may send emails on behalf of your domain. Example: v=spf1 include:_spf.google.com ~all

▸ How to fix this — step-by-step guide

SPF (Sender Policy Framework) defines in DNS which servers may send emails on behalf of your domain. Without SPF any phisher can spoof emails from you — and recipients are more likely to fall for them.

WordPress Special for WordPress: where to add this

WordPress plugin: DNS matter, not WordPress. Create a TXT record in your DNS panel. Examples: If you send NO emails: v=spf1 -all (reject all senders). If only your host sends: v=spf1 a mx ~all. If Google Workspace: v=spf1 include:_spf.google.com ~all. If Microsoft 365: v=spf1 include:spf.protection.outlook.com -all.

✓ How to verify it works: dig TXT your-domain.com | grep spf — or online https://www.kitterman.com/spf/validate.html.

No DMARC record. The domain is vulnerable to email phishing.

☛ Action needed: Create a DMARC DNS record at _dmarc.yourdomain.com. DMARC protects against phishing and email spoofing. Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

▸ How to fix this — step-by-step guide

DMARC combines SPF and DKIM into an explicit instruction for receiving mail servers: "What to do if emails claim to come from us but SPF/DKIM fail?" Without DMARC each server decides — usually generously. With DMARC=reject you effectively prevent phishing in your name.

WordPress Special for WordPress: where to add this

WordPress plugin: DNS matter. TXT record at subdomain _dmarc.your-domain.com. Recommended stages: Observe first: v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com — review reports for weeks. Then tighten: v=DMARC1; p=quarantine; rua=… — suspicious mails go to spam. Final: v=DMARC1; p=reject; rua=… — they’re refused outright.

✓ How to verify it works: dig TXT _dmarc.your-domain.com — or online https://dmarcian.com/dmarc-inspector/.

0 Security Contact (security.txt)

No security.txt file found (RFC 9116). Security researchers don't know how to report vulnerabilities.

☛ Action needed: Create a security.txt file at /.well-known/security.txt. This allows security researchers to responsibly report vulnerabilities. Required fields: Contact (email or URL) and Expires (expiration date).

▸ How to fix this — step-by-step guide

A security.txt (RFC 9116) tells security researchers how to responsibly report vulnerabilities to you. Without it, reports may go to spam or never be sent. A plain text file at the correct path is enough.

Apache server (classic hosting at most providers)

File: /.well-known/security.txt (create the folder if it doesn’t exist)

Contact: mailto:security@your-domain.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, de
Canonical: https://your-domain.com/.well-known/security.txt

⚠ Replace "security@your-domain.com" with your actual security contact (or a generic info@). "Expires" must be a future date and should be renewed regularly. The file is plain .txt, not PHP.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: security.txt file in /.well-known/ under your WordPress root

Contact: mailto:security@your-domain.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, de
Canonical: https://your-domain.com/.well-known/security.txt

⚠ Via FTP/SFTP create a folder ".well-known" in the WordPress root (the leading dot matters — some FTP tools need "show hidden files" enabled), inside save the file security.txt with the content above. If WordPress redirects the URL: add to .htaccess: RewriteRule ^\.well-known/ - [L]

WordPress plugin: Plugin "security.txt" (search the plugin directory) lets you configure this in the WordPress backend without FTP.

✓ How to verify it works: Open https://your-domain.com/.well-known/security.txt in a browser — content must be visible (no 404).

75 External Reporting Endpoints

Network Error Logging (NEL) active — network errors are reported to an external service.

☛ Action needed: Network Error Logging sends error data to external servers. Ensure this data transfer is mentioned in your privacy policy and that the recipient operates in compliance with GDPR.

▸ How to fix this — step-by-step guide

Network Error Logging (NEL) reports network errors to an external server. As with external reporting: mention in privacy policy and verify GDPR compliance of the recipient.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always unset NEL
    Header always unset Report-To
</IfModule>

⚠ If you don’t actively need NEL: these two lines remove both reporting headers. If you do: document it in the privacy policy.

WordPress Special for WordPress: where to add this

Option 1: via .htaccess (recommended — no theme editing)

File: .htaccess in the WordPress root

<IfModule mod_headers.c>
    Header always unset NEL
    Header always unset Report-To
</IfModule>

⚠ If headers come from a plugin, configure the plugin instead.

✓ How to verify it works: F12 → Network → first request → Response Header: NO "nel" or "report-to" anymore (or deliberately documented).

Data is reported to external service: Report-To: a.nel.cloudflare.com

☛ Action needed: Your website sends reports to external services. Check whether your privacy policy covers this data transfer and whether the external service is GDPR-compliant. If the service is outside the EU, the same rules apply as for third-party servers.

▸ How to fix this — step-by-step guide

Your site sends error or CSP reports to an external service (Report-To: a.nel.cloudflare.com). GDPR-relevant: at least IP address and URL are transmitted. Verify (a) the recipient is GDPR-compliant, (b) the transfer is mentioned in your privacy policy, (c) a data processing agreement (DPA) exists.

WordPress Special for WordPress: where to add this

WordPress plugin: If you didn’t set up the reporting endpoint yourself, it usually comes from a plugin (e.g. Sentry, Rollbar, Datadog). Check the plugin configuration — either disable, replace with an EU vendor, or gate behind consent.

✓ How to verify it works: Privacy policy contains an entry about error reporting + DPA is in place. In incognito: F12 → Network → no unintended reporting requests.

85 Cookie Consent

Cookie consent system detected: Unbekannt.

Consent banner is visible to visitors.

Trackers are loaded on page load — possibly BEFORE consent is given.

☛ Action needed: Trackers are loaded on page load, possibly before the visitor has consented. Ensure your consent system only activates trackers AFTER consent (opt-in, not opt-out).

▸ How to fix this — step-by-step guide

Your trackers are loaded BEFORE the user can consent ("pre-consent loading"). Common misconfiguration in cookie plugins — banner appears, but too late: the GA script is already running. Violates ePrivacy.

WordPress Special for WordPress: where to add this

WordPress plugin: Almost always caused by the theme or a tracking plugin that embeds the tracker code directly (e.g. "Google Analytics for WordPress" with auto-insert). Fix: 1) remove tracking code from the theme/plugin. 2) In the consent plugin (Complianz/Real Cookie Banner): register the tracker as a "service", paste the snippet there — the plugin will load it only after consent. 3) ALTERNATIVELY: plugin "PYS PixelYourSite" combined with consent gating. Do NOT rely on "GA anonymized before consent" — legally unsettled and risky.

✓ How to verify it works: Incognito → F12 → Network (clear all, start recording) → load page, do NOT click banner, wait 10 seconds → there must be NO requests to google-analytics.com, googletagmanager.com, facebook.com/tr, doubleclick.net etc.

100 Privacy Policy & Legal Notice

Legal notice linked: "Montag-Freitag" (https://www.aeris.de/pages/impressum).

⚙ Your ready-to-use security .htaccess

All missing security headers combined into one block. Append this block to the end of your .htaccess — done. 7 headers will be set.

⚠ Why this recommendation does NOT give a 100% score — and why that's how it is with WordPress

The Content-Security-Policy above deliberately includes 'unsafe-inline' for both style-src and script-src. This does NOT provide full XSS protection — it's a pragmatic trade-off, not a bug.

Why? A typical WordPress setup (theme + 5-15 plugins) emits 10-50 different inline <script> blocks into the HTML: jQuery init, slider init, cookie banner, tracking, GTM, web vitals, lazy-load, speculation rules and so on. A strict script-src 'self' blocks them all — the site becomes visually and functionally broken (blank slider, broken cookie banner, dead plugins).

Consequence for scoring: Sites running WordPress with plugins can score at most ~75-85 points in the CSP category in this app — the full 100% rating is only achievable when inline code is signed via nonce or hash (technically demanding, breaks on every theme/plugin update).

Paths to full XSS protection (in increasing complexity):

Plugin "WP Content Security Policy & Headers" — automatically adds nonces to inline scripts (medium effort, cleanest WP solution).
Hash-based CSP — whitelist every inline script via SHA-256 in the CSP (fragile, breaks on updates).
Externalize inline scripts — rebuild theme/plugins so no inline JS is emitted (huge effort, often impossible).

Anyone who doesn't take one of these paths lives with 'unsafe-inline' — like about 95% of all production WordPress sites on the web. The other CSP directives still protect: default-src 'self' blocks external resources, object-src 'none' bans Flash/Java, frame-ancestors 'self' prevents clickjacking, base-uri 'self' prevents base-tag hijacking. Not maximum protection, but realistic protection for WP reality.

⚠ Important on Hetzner-Konsoleh webhosting (managed / shared hosting)

On Hetzner-Konsoleh webhosting (and comparable shared hosts like All-Inkl, IONOS, Strato, 1blu, …), Apache throws a 500 Internal Server Error as soon as Header always edit Set-Cookie … expr=… appears in .htaccess. The Apache error log says:

Can't parse envclause/expression: syntax error, unexpected T_OP_STR_EQ, expecting $end

This is not a WebForensik bug and not a typo — the shared host has blocked the mod_headers expr= subset via AllowOverride limits (for security, because Header edit could also manipulate cookies of other tenants).

☛ For Hetzner-Konsoleh users: use the variant below marked with the red "Hetzner / Shared" badge. It consists of two files (.htaccess + wp-config.php) instead of one, but avoids the 500 error reliably. Cookie flags go into wp-config.php instead of .htaccess.

Apache Standard Apache (any host, without WordPress)

Append this block to the end of your .htaccess in the web root — done.

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"

    # Fehlende Cookie-Flags konditional ergänzen (nur wenn nicht schon gesetzt)
    Header always edit Set-Cookie "^(.*)$" "$1; Secure" "expr=!(resp('Set-Cookie') -strmatch '*Secure*')"
    Header always edit Set-Cookie "^(.*)$" "$1; HttpOnly" "expr=!(resp('Set-Cookie') -strmatch '*HttpOnly*')"
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>

Hetzner / Shared Hetzner-Konsoleh / Managed Hosting (two files)

This variant avoids the 500 Internal Server Error on Hetzner-Konsoleh and similar shared hosts (All-Inkl, IONOS, Strato, 1blu …): the .htaccess only contains the header directives (no "Header edit"), cookie flags move into wp-config.php. Two files to edit instead of one, but guaranteed to run.

1. File: .htaccess in the WordPress root

# BEGIN WebForensik Security
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"
</IfModule>
# END WebForensik Security

2. File: wp-config.php in the WordPress root

Insert ABOVE the line "/* That's all, stop editing! */". Back up wp-config.php first!

// === WebForensik: Cookie-Hardening (Hetzner-Konsoleh-tauglich) ===
// Bitte OBERHALB der Zeile "/* That's all, stop editing! */" einfügen.
// Wirkt auf PHP-Session- und WordPress-Login-Cookies.
// Plugin-eigene Cookies (z.B. WooCommerce, Cookie-Banner) müssen in den
// Plugin-Einstellungen separat auf "Secure" gestellt werden.
@ini_set('session.cookie_secure',   '1');
@ini_set('session.cookie_httponly', '1');
@ini_set('session.cookie_samesite', 'Lax');
if (!defined('FORCE_SSL_ADMIN')) define('FORCE_SSL_ADMIN', true);

WordPress WordPress: .htaccess in WP root

Insert this block ABOVE the "# BEGIN WordPress" line, otherwise WP overwrites it on permalink changes.

# BEGIN WebForensik Security
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()"

    # Fehlende Cookie-Flags konditional ergänzen
    Header always edit Set-Cookie "^(.*)$" "$1; Secure" "expr=!(resp('Set-Cookie') -strmatch '*Secure*')"
    Header always edit Set-Cookie "^(.*)$" "$1; HttpOnly" "expr=!(resp('Set-Cookie') -strmatch '*HttpOnly*')"
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>
# END WebForensik Security

WordPress Alternative for WordPress: functions.php in child theme

If your host disallows .htaccess changes: append this PHP snippet to the end of your CHILD theme's functions.php. Back up first — NEVER edit the parent theme, it gets overwritten on updates.

add_action('send_headers', function () {
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
    header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests");
    header("Referrer-Policy: strict-origin-when-cross-origin");
    header("Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=(), browsing-topics=()");
});

// Cookie-Flags für PHP-Session-Cookies — wirkt nur auf $_SESSION,
// NICHT auf von Plugins/Themes per setcookie() gesetzte Cookies.
// Für umfassende Cookie-Absicherung die .htaccess-Variante oben verwenden.
add_action('init', function () {
    if (headers_sent()) return;
    @ini_set('session.cookie_secure', '1');
    @ini_set('session.cookie_httponly', '1');
    @ini_set('session.cookie_samesite', 'Lax');
}, 1);

Dry-run — we re-load your site with the proposed headers and show which resources would be blocked. Takes about 30 seconds.

HTTP Response Headers

Header	Value
accept-ch	Sec-CH-Viewport-Width
alt-svc	h3=":443"; ma=86400
cdn-cache-control	no-cache, no-store
cf-cache-status	DYNAMIC
cf-ray	a557f503dd620177-CDG
content-encoding	br
content-language	de-DE
content-length	158597
content-security-policy	block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;
content-type	text/html; charset=utf-8
date	Thu, 05 Nov 2026 01:06:39 GMT
etag	"sfr:computation:v2:0da5ada0d09ad603e99d91d860e1097178341a01d6e6a7401573fbfb1ae300aa:62b1a0a3e6f38515e1ba729bee211379"
link	<https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin, <https://cdn.jsdelivr.net>; rel="preconnect", <//www.aeris.de/cdn/shop/files/pandectes-rules.js?v=2891826403494317556>; as="script"; rel="preload", <//www.aeris.de/cdn/shop/t/582/assets/theme.css?v
nel	{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
powered-by	Shopify
product-filtering-backend	bitset_roaring
report-to	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0D0h2Rr317G2GYaQ%2BJjsFurOdWpyME2thuNy6dysnudilrXqj0F1KMGt3TZ%2Fg%2FyDLxCyNe%2F9ScE3YMDrOj7v1vNm1JOpwyt8moB7qDxit1JsT1a2k0yiy%2FnfWoSRMebf9EqipW6P2JueTQ%3D%3D"}]}
server	cloudflare
server-timing	processing;dur=432, db;dur=309, render;dur=131, asn;desc="24940", edge;desc="CDG", country;desc="DE", theme;desc="163251913050", pageType;desc="index", servedBy;desc="xfsq", requestID;desc="5ee17360-3508-419b-abd0-2c11e21c24c6-1793840799", _y;desc="00000000-0000-0000-5000-000000000000", _s;desc="000
set-cookie	_shopify_essential=:AaGpPl6AAAEA19lJfsBNYhwFmGP5GU7Veyi0ZD-qIsrQW2IGABL2U0NJK7IpP1OafxyUMS-qy4u1wKYw2M5bknaE4TM:; Max-Age=31536000; Path=/; HttpOnly; Secure; Priority=High; SameSite=Lax localization=DE; path=/; expires=Fri, 05 Nov 2027 01:06:39 GMT; SameSite=Lax cart_currency=EUR; path=/; expires=Th
shopify-complexity-score	4310
shopify-complexity-score-v2	431
strict-transport-security	max-age=7889238
vary	Accept accept-encoding
x-content-type-options	nosniff
x-dc	gcp-europe-west1,gcp-europe-west1,gcp-europe-west1
x-download-options	noopen
x-frame-options	DENY
x-permitted-cross-domain-policies	none
x-request-id	5ee17360-3508-419b-abd0-2c11e21c24c6-1793840799
x-xss-protection	1; mode=block

New Scan · Compare

Embed your score on your website

Show your WebForensik score publicly. The badge is a lightweight SVG, loads fast, and respects your visitors' privacy (no tracking).

HTML code to embed (this specific scan)

<a href="https://webforensik.de/results.php?id=4097" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?id=4097" alt="WebForensik Score" width="174" height="28">
</a>

Or dynamically — always shows the latest scan of this domain

<a href="https://webforensik.de/?url=https://aeris.de" target="_blank" rel="noopener">
  <img src="https://webforensik.de/badge.php?domain=aeris.de" alt="WebForensik Score" width="174" height="28">
</a>