content-security-policy

Content Security Policy (CSP) header not implemented

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Public content is visible via cross-origin resource sharing (CORS) Access-Control-Allow-Origin header

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header not implemented

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

Diagnostics

Metrics

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS SaaS Service Detection

EventListener contains a cross-site scripting vulnerability via the document object model (DOM). An attacker can execute arbitrary script which can then allow theft of cookie-based authentication credentials and launch of  other attacks.

DOM EventListener - Cross-Site Scripting

Wappalyzer Technology Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

RDAP (Registration Data Access Protocol) is a standard defined by the IETF to replace the whois protocol
in queries for information about Internet resource records such as domain names, IP addresses, and ASNs.


RDAP WHOIS

Detects Matrix servers based on .well-known entries. See https://en.wikipedia.org/wiki/Matrix_(protocol)

Matrix Server Detect

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

Multi

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Nuxt is a Vue framework for developing modern web applications.

Nuxt.js

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.

jsDelivr

Netlify providers hosting and server-less backend services for web applications and static websites.

Netlify

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Type	URL	Remédiation
jsdelivr	cdn.jsdelivr.net/npm/@mdi...	Host files locally
github	raw.githubusercontent.com...	Dont link GitHub ressources, host them directly
unknown	cdn.matomo.cloud/multi.ma...
unknown	multi.matomo.cloud/matomo...

Hostname	IP	City	Country
multi.matomo.cloud	18.195.235.189	Francfort-sur-le-Main	Allemagne
www.multi.coop	44.219.53.183	Ashburn	États Unis
cdn.jsdelivr.net	146.75.37.229	?	États Unis
raw.githubusercontent.com	185.199.108.133	?	États Unis
cdn.matomo.cloud	3.162.125.8	?	États Unis

DashLord

https://www.multi.coop

LightHouse

https://www.multi.coop/

Eco-index

GES: 1.82 gramme(s) par visite

Eau : 2.73 cl par visite

Ça veut dire quoi ?

Scripts tiers et cookies

Déclaration de mise en accessibilité